Compare three proven patterns for serving private files from S3-compatible storage and learn when to use backend proxying, gateway auth, or presigned URLs.