Adds exact-origin HTTP Basic Auth for protected media sources. Authenticated files are fetched server-side with remote redirects disabled, streamed to a temporary uploads file, and published atomically. Includes controlled cleanup for remote and local failures plus updated local and production configuration guidance.