fix: deep link

app/Http/Controllers/MediaController.php

@@ -99,6 +99,11 @@ public function index(Request $request)
             ->orderBy('created_at', 'desc')
             ->get();
 
+        // Same external_url fallback as the normal listing below.
+        $hidden->each(function ($m) {
+            $m->external_url = $m->external_url ?: ($m->url ?? '');
+        });
+
         return response()->json($hidden);
     }
 
@@ -491,8 +496,9 @@ public function show($id)
 }
 
 // Public (no auth) deep link lookup by ID. Returns the same shape as show()
-// minus the user-specific fields. Hidden (deeplink-only) media is included,
-// since the deep link is how such media is discovered.
+// minus the user-specific fields. Serves any publicly visible media plus the
+// hidden (deeplink-only) ones, since the deep link is how those are discovered
+// — https://aramejan.com/media/{id} must resolve for every shareable media.
 public function publicShow($id)
 {
     $media = Media::with([
@@ -506,7 +512,10 @@ public function publicShow($id)
             },
         ])
         ->where('id', $id)
-        ->where('is_deeplink_only', true)
+        ->where(function ($q) {
+            $q->where('visibility', 'public')
+              ->orWhere('is_deeplink_only', true);
+        })
         ->firstOrFail();
 
     return response()->json([