fix(ai-harness-cli): serve signs media URLs with a key derived from the token, so a short token meets the 32-byte key rule