Route signed connector media through a shared MIME-aware response helper so dangerous active content downloads with octet-stream and nosniff headers while safe images remain inline-compatible.
Preserve media token, expiry, and path-boundary checks for LINE and WhatsApp media routes.
Validation: targeted connector media tests passed; full Windows test gate passed.