Returns the tenant's brand image library, newest first. An image is never scanned for its own sake: it is cross-referenced against the findings that match the identifiers it is linked to. thumbnailUrl is a presigned GET that expires in 15 minutes and is for display, not storage. Admin-only read; no paid entitlement required. Requires the brand image library to be enabled for the tenant - otherwise 403 with ErrorCode FEATURE_DISABLED.