docs: Drop instance-specific storage-security notes

The public repo must not document this instance's object-storage
access-control posture; findings like that belong in private ops
notes. The engineering guidance (never rely on URL obscurity, always
request file tokens) stays.

BACKLOG.md

@@ -38,12 +38,14 @@ focus colors, always-focusable Sign in with inline validation. Deferred from rev
 - Logout / switch account: sign-out entry exists; add switch-account (re-login screen
   without losing scroll state).
 - Release build: enable `minifyEnabled` + R8 rules, decide signing/versioning.
-- Thumbnails of private/internal videos may 404 — verified on tube.jeena.net:
-  instance thumbnail paths are publicly readable (HTTP 200 without auth); add a
-  fallback poster only if other instances behave differently.
-- Security note for tube.jeena.net: object-storage (R2) media for private test
-  videos is publicly readable without token ("private" only via URL obscurity).
-  Flag to the instance admin; the app must not rely on this laxness.
+- Thumbnails of private/internal videos may 404 — on some instances thumbnail
+  paths are publicly readable while on others they need auth; add a fallback
+  poster only if needed.
+- Security note (verified live against tube.jeena.net): some instances serve
+  non-public media / thumbnails from object storage with only URL-based access
+  control. The app must not rely on that laxness; always send auth headers
+  / file tokens for non-public media. (Detail intentionally omitted from the
+  public repo — report instance-specific findings privately.)
 - Verify `searchTarget=local` channel search behaves well for instances without
   federation; consider `search/video-channels` endpoint as an alternative.
 - Release build: enable `minifyEnabled` + R8 rules, decide on signing, versioning scheme.