新增

app/tests/test_api_client.py

@@ -134,6 +134,27 @@ def test_get_retries_only_timeouts_then_returns_data() -> None:
     assert attempts == 3
 
 
+def test_get_bytes_downloads_relative_public_image_without_api_token() -> None:
+    """Generated QR images bypass the JSON envelope and never leak the API token."""
+
+    requests: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(200, headers={"content-type": "image/png"}, content=b"png-data")
+
+    with ApiClient(
+        "https://example.test/root",
+        token="private-token",
+        transport=httpx.MockTransport(handler),
+    ) as client:
+        assert client.get_bytes("/uploads/qrcode.png") == b"png-data"
+
+    request = requests[0]
+    assert str(request.url) == "https://example.test/uploads/qrcode.png"
+    assert "token" not in request.headers
+
+
 @pytest.mark.parametrize(
     ("code", "exception_type"),
     [