Remediate the 2026-09-03 feature-test findings

shopdb/core/api/models.py

@@ -235,7 +235,6 @@ def upload_model_image(model_id: int):
 
 
 @models_bp.route('/image/<path:filename>', methods=['GET'])
-@require_permission('assets.view')
 def serve_model_image(filename):
     """Serve an uploaded model image (public - asset detail pages read it)."""
     return send_upload(_modelimage_dir(), filename)