docs: Drop instance-specific storage-security notes

The public repo must not document this instance's object-storage
access-control posture; findings like that belong in private ops
notes. The engineering guidance (never rely on URL obscurity, always
request file tokens) stays.

.gitignore

@@ -7,4 +7,6 @@
 /app/build
 /captures
 .externalNativeBuild
-.cxxreports/*-shots/
+.cxx
+reports/*-shots/
+reports/*.md

AGENTS.md

@@ -69,9 +69,10 @@ setup/login screen, `Ready` renders `HomeScreen`, which switches content on a
     whose media lives in a private object-storage bucket — pass the short-lived
     `POST /api/v1/videos/{shortUuid}/token` token as `?videoFileToken=` on those URLs
     (response shape: `{ files: { token, expires } }`; verified live).
-  - tube.jeena.net itself streams non-public media from a **publicly readable R2
-    bucket** (`pub-….r2.dev`): no auth is enforced there today, but do not rely on
-    that — always request the file token for non-public videos.
+  - Some instances stream non-public media from object-storage hosts with only
+    URL-based access control — never rely on that; always request and use the
+    file token for non-public videos. (Instance-specific findings stay out of
+    the public repo and live in the private ops notes/agent-local instructions.)
 
 ## Conventions
 

BACKLOG.md

@@ -38,12 +38,14 @@ focus colors, always-focusable Sign in with inline validation. Deferred from rev
 - Logout / switch account: sign-out entry exists; add switch-account (re-login screen
   without losing scroll state).
 - Release build: enable `minifyEnabled` + R8 rules, decide signing/versioning.
-- Thumbnails of private/internal videos may 404 — verified on tube.jeena.net:
-  instance thumbnail paths are publicly readable (HTTP 200 without auth); add a
-  fallback poster only if other instances behave differently.
-- Security note for tube.jeena.net: object-storage (R2) media for private test
-  videos is publicly readable without token ("private" only via URL obscurity).
-  Flag to the instance admin; the app must not rely on this laxness.
+- Thumbnails of private/internal videos may 404 — on some instances thumbnail
+  paths are publicly readable while on others they need auth; add a fallback
+  poster only if needed.
+- Security note (verified live against tube.jeena.net): some instances serve
+  non-public media / thumbnails from object storage with only URL-based access
+  control. The app must not rely on that laxness; always send auth headers
+  / file tokens for non-public media. (Detail intentionally omitted from the
+  public repo — report instance-specific findings privately.)
 - Verify `searchTarget=local` channel search behaves well for instances without
   federation; consider `search/video-channels` endpoint as an alternative.
 - Release build: enable `minifyEnabled` + R8 rules, decide on signing, versioning scheme.