When the thumbnail fails, AvatarURL and OrganisationLogoURL answered
"/" + the blob key, which skips storage.uploads.public_path_prefix and
public_url (a 404 with the WinterCMS layout). They now answer the
original's attach.File.URL.
- TestMemberTokenScopes walks E-2's acceptance list item by item, plus the
per-application catalog and the legacy MintAPIToken fallback;
TestMemberTokenScopesBoot (no Docker) the boot refusals
- TestBackendLinkAuthTime (C-CR-02), TestBackendLinkShowPost (C-WR-01,
C-IN-06), TestAccessRevocation (C-CR-01), TestUserMCPGuardClientIP
(C-IN-04), TestAPITokenRevokeEvent (C-IN-02), TestOrganisationLogo (E-1)
- README Testing section names them
