Helmet's default 'Cross-Origin-Resource-Policy: same-origin' header was blocking the frontend (http://localhost:5173) from loading images and audio served by the backend at /uploads/*. Set policy to 'cross-origin' so images can be embedded in the frontend. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>