# Inside the site's HTTPS server block; files are verified before publication.
# Hash URLs can be cached; retirement must replace article mappings and clear caches.
location ^~ /images/illustrations/ {
    if ($uri !~ "^/images/illustrations/[a-f0-9]{64}\.(webp|png|jpg|gif)$") { return 404; }
    try_files $uri =404;
    etag on;
    add_header Cache-Control "public, max-age=31536000, immutable";
    add_header X-Content-Type-Options nosniff always;
    add_header X-Illustration-Delivery static always;
}