Legacy /i and /h two-segment routes remain supported in the router and viewer.
Encrypt image bytes in the browser, keep keys out of POST bodies (URL fragment or path secret), and POST ciphertext via typed upload API helpers.