feat(images): default frontend assets to image service

.env.example

@@ -31,13 +31,15 @@ GATEWAY_DB_SCHEMA=public
 GATEWAY_WORKSPACE_ROOT=/path/to/core2026
 GATEWAY_WORKTREE_ROOT=/path/to/core2026/.worktrees
 GATEWAY_USER_ICON_DIR=uploads/user-icons
-GATEWAY_USER_ICON_PUBLIC_URL=http://localhost:13000/user-icons
+GATEWAY_USER_ICON_PUBLIC_URL=https://sam-image.hided.net/icons
 GATEWAY_IMAGE_UPLOAD_URL=https://sam-image.hided.net
 GATEWAY_IMAGE_UPLOAD_SECRET_FILE=/run/secrets/image_upload_core2026_secret
 GATEWAY_SHARED_ICON_PUBLIC_URL=https://sam-image.hided.net/icons
 GAME_IMAGE_UPLOAD_URL=https://sam-image.hided.net
 GAME_IMAGE_UPLOAD_SECRET_FILE=/run/secrets/image_upload_core2026_secret
 GAME_CONTENT_IMAGE_PUBLIC_URL=https://sam-image.hided.net/uploads/core2026
+IMAGE_SYNC_URL=https://sam-image.hided.net
+IMAGE_SYNC_SECRET_FILE=/run/secrets/image_sync_core2026_secret
 GATEWAY_LOCAL_REGISTRATION_ENABLED=true
 GATEWAY_LOCAL_ACCOUNT_GRACE_DAYS=7
 # Optional. Keep the PEM private key outside Git; if omitted, a per-process RSA key is generated.
@@ -65,10 +67,11 @@ TRPC_PATH=/trpc
 # Frontend public URLs
 # These values are public and become part of the browser bundle.
 VITE_GATEWAY_WEB_URL=/gateway/
+VITE_IMAGE_PUBLIC_URL=https://sam-image.hided.net
 # Comma-separated public hostnames accepted by Vite preview. Use * only behind a trusted reverse proxy.
 VITE_PREVIEW_ALLOWED_HOSTS=localhost,dev-sam-e2e.hided.net
-# Account-uploaded icons are served by the Gateway and remain a public browser URL.
-VITE_GATEWAY_USER_ICON_BASE_URL=/gateway/api/user-icons
+# Account-uploaded icons are public immutable files on the image service.
+VITE_GATEWAY_USER_ICON_BASE_URL=https://sam-image.hided.net/icons
 VITE_BOARD_COMMUNITY_URL=/xe/community
 # Set the remaining links only after their public routes are confirmed.
 VITE_BOARD_REQUEST_URL=