Close security hole in image optimization

A new api endpoint /api/opt has been added to re-compress and strip jpeg images for pdf export. Currently it could be used for other purposes so it either needs to be locked down with a secret or removed and have PDF exports done entirely on trigger. OR test new sharp version in render pipeline of /export page