docs: Drop instance-specific storage-security notes

The public repo must not document this instance's object-storage
access-control posture; findings like that belong in private ops
notes. The engineering guidance (never rely on URL obscurity, always
request file tokens) stays.

AGENTS.md

@@ -69,9 +69,10 @@ setup/login screen, `Ready` renders `HomeScreen`, which switches content on a
     whose media lives in a private object-storage bucket — pass the short-lived
     `POST /api/v1/videos/{shortUuid}/token` token as `?videoFileToken=` on those URLs
     (response shape: `{ files: { token, expires } }`; verified live).
-  - tube.jeena.net itself streams non-public media from a **publicly readable R2
-    bucket** (`pub-….r2.dev`): no auth is enforced there today, but do not rely on
-    that — always request the file token for non-public videos.
+  - Some instances stream non-public media from object-storage hosts with only
+    URL-based access control — never rely on that; always request and use the
+    file token for non-public videos. (Instance-specific findings stay out of
+    the public repo and live in the private ops notes/agent-local instructions.)
 
 ## Conventions