fix: workspace-aware media resolution + production-ready logging

- load_podcast_image_bytes now accepts user_id for workspace-aware resolution
- Video and avatar handlers pass user_id to image loading
- Strip JWT tokens from console logs (dev-only verbose logging)
- Guard debug logs behind NODE_ENV===development in SceneCard, useRenderQueue, SubscriptionContext, mediaCache
- Add devLogger utility

frontend/src/utils/devLogger.ts

@@ -0,0 +1,20 @@
+const isDev = process.env.NODE_ENV === 'development';
+
+export const devLog = {
+  log: (...args: any[]) => { if (isDev) console.log(...args); },
+  warn: (...args: any[]) => { if (isDev) console.warn(...args); },
+  error: (...args: any[]) => { console.error(...args); },
+  info: (...args: any[]) => { if (isDev) console.info(...args); },
+};
+
+export const sanitizeUrl = (url: string): string => {
+  try {
+    const parsed = new URL(url, window.location.origin);
+    if (parsed.searchParams.has('token')) {
+      parsed.searchParams.set('token', '***');
+    }
+    return parsed.pathname + (parsed.search ? parsed.search : '');
+  } catch {
+    return url.split('?')[0];
+  }
+};

frontend/src/utils/mediaCache.ts

@@ -102,9 +102,11 @@ class MediaCache {
       this.evictOldest();
     }
 
-    console.log(`[MediaCache] Cached ${mediaType}:`, url, 
-      sceneId ? `(scene: ${sceneId})` : '', 
-      projectId ? `(project: ${projectId})` : '');
+if (process.env.NODE_ENV === 'development') {
+      console.log(`[MediaCache] Cached ${mediaType}:`, url.split('?')[0],
+        sceneId ? `(scene: ${sceneId})` : '',
+        projectId ? `(project: ${projectId})` : '');
+    }
   }
 
   /**