SAMPLE EVIDENCE for PD-03 (made-up app Tidyhaus; not a real review)

GET /storage/v1/object/job-photos/[user A]/kitchen.jpg signed out -> 400 "Object not found"; as user B -> 400. Signed URL with a 60-second expiry -> 400 after 2 minutes.