add payment_link and banks

docker/nginx.conf

@@ -21,6 +21,12 @@ server {
         access_log off;
     }
 
+    # Financial evidence requires a current authenticated application permission check.
+    # Never expose it through bearer-style signed media links.
+    location ^~ /protected-media/payments/ {
+        return 404;
+    }
+
     location /protected-media/ {
         alias /app/media/;
         secure_link $arg_md5,$arg_expires;