fix: avoid duplicate user prefix in /media/paintings redirect
get-painting returns painting.slug that is already fully qualified
(\"auth0|.../painting/<timestamp>\"), so unconditionally prepending
painting.user produced keys like \"auth0|.../auth0|.../painting/TS.png\"
and the Spaces bucket 403'd. Guard the prepend so it only fires when
the slug is a bare one.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>