a framing slot renders the original, not a rung

The preview asked `derived/` for a 640-wide rung and drew it about 1900 pixels wide — stretched three
times over, which reads as a poor photograph rather than as the wrong file. Raising the rung only moves
the problem: the box is most of a panel wide and can be zoomed on top of that, so any rung chosen in
advance is chosen wrong, and the widest one available is whatever the ladder happens to hold.

The original has every pixel there is. It is also, often, a HEIC that no browser can decode — which is
what av-club is for, and the platform already renders those for its own file browser through exactly
this path.

So there is a `/original/*` route: it resolves a path inside `originals/`, forwards to av-club's
`/v1/render` with a width, and streams back something a browser can draw. It decodes nothing itself.
That is the standing rule and the reason there is no image library in this plugin.

Not cached on disk, like the platform's own /render and for the same reason: a full-size render is
large, looked at once, and keyed on a width the panel chose. Caching it would fill a disk to make the
second look at one photograph faster.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

api/router.ts

@@ -2,6 +2,7 @@ import type { Context } from 'hono';
 import { createRouter, type HonoVariables } from '@@/create-router';
 import { registerProxiedPrefix } from '@@/sidecar/proxied-prefixes';
 import { deleteConnection, readConnection, readCredentials, recordProbe, saveConnection } from './connection';
+import { sidecarPort } from '@@/sidecar-registry';
 import { readSettings, saveRootPath } from './settings';
 import { readWebsiteStatus, cloneWebsite, updateWebsite } from './website';
 import { readMediaStatus, createMediaDir } from './media';
@@ -306,6 +307,65 @@ router.get('/derived/*', async (ctx) => {
   });
 });
 
+/**
+ * An ORIGINAL, rendered at a width, for the admin to draw at size.
+ *
+ * ── Why not the derived ladder ──
+ *
+ * A framing slot is most of the panel wide — around 1900 CSS pixels — and can be zoomed into on top of
+ * that. Asking `derived/` for a rung means choosing one in advance and being wrong: 640 stretched three
+ * times over reads as a poor photograph rather than as the wrong file, and the widest rung available is
+ * whatever the ladder happens to hold.
+ *
+ * The original has every pixel there is. It is also, often, something a browser cannot decode — a HEIC
+ * off a phone — which is exactly what av-club is for.
+ *
+ * ── Every encoder is av-club ──
+ *
+ * `/v1/render` takes a path and a width and answers with something a browser can draw, whatever went
+ * in. This route resolves the path inside `originals/` and forwards; it decodes nothing itself, which
+ * is the standing rule and the reason there is no image library in this plugin.
+ */
+router.get('/original/*', async (ctx) => {
+  const user = ctx.get('user');
+  const settings = await readSettings(user.email);
+  if (!settings.rootPath) return ctx.json({ error: 'No root location is set.' }, 400);
+
+  const url = new URL(ctx.req.url);
+  const after = url.pathname.slice(url.pathname.indexOf('/original/') + '/original/'.length);
+  const relative = decodeURIComponent(after);
+
+  const base = join(settings.rootPath, 'media', 'originals');
+  const full = resolve(join(base, relative));
+  // `resolve` first, then compare against the directory plus a separator as well as itself — a bare
+  // startsWith accepts `originals-old` for a root of `originals`.
+  if (full !== base && !full.startsWith(base + sep)) return ctx.json({ error: 'Not found' }, 404);
+  if (!(await Bun.file(full).exists())) return ctx.json({ error: 'Not found' }, 404);
+
+  // Clamped at both ends: below 256 nothing is worth rendering, and above 4096 a panel is asking for
+  // more pixels than any screen it runs on. The same bounds the platform's own /render uses.
+  const asked = Number(url.searchParams.get('width'));
+  const width = Number.isFinite(asked) && asked > 0 ? Math.min(Math.max(asked, 256), 4096) : 1600;
+
+  const port = sidecarPort('av-club');
+  if (!port) return ctx.json({ error: 'av-club is not running.' }, 503);
+
+  const rendered = await fetch(
+    `http://127.0.0.1:${port}/v1/render?path=${encodeURIComponent(full)}&width=${width}`,
+    { headers: { 'x-officer-user': user.email } },
+  );
+  if (!rendered.ok) return ctx.json({ error: 'That file could not be rendered.' }, 422);
+
+  return new Response(await rendered.arrayBuffer(), {
+    headers: {
+      'Content-Type': rendered.headers.get('content-type') ?? 'image/webp',
+      // Not cached on disk. A full-size render is large, looked at once, and keyed on a width the panel
+      // chose — caching it would fill a disk to make the second look at one photograph faster.
+      'Cache-Control': 'private, max-age=300',
+    },
+  });
+});
+
 router.get('/_config/media/files', async (ctx) => {
   const user = ctx.get('user');
   const scope = ctx.req.query('path') ?? '';