[Bug]: Image proxy returns 400 Bad Request for delegated/shared mailbox users (works fine for account owner)

Steps to reproduce

Is this a bug report or feature request?

• This is a bug report.
• I have searched the existing issues and could not find a duplicate covering this exact combination (delegated account + image proxy 400).

Nextcloud Server and Mail app version

• Mail app version: 5.10.11
• Nextcloud Server version: Nextcloud Hub 26 Spring (34.0.0)

Steps to reproduce

1. Set up a mailbox that is shared/delegated to a second Nextcloud user (delegated account access in the Mail app).
2. As the mailbox owner, open an HTML email containing remote/external images (e.g. a newsletter with tracking pixels and product images hosted on a third-party domain).
3. As the delegated user, open the same email (via the shared/delegated mailbox).

Expected behavior

Images load correctly for the delegated user, the same way they do for the mailbox owner, since the Mail app's built-in image proxy (/apps/mail/proxy?id=...&hmac=...&src=...) should work regardless of which account (owner or delegate) is viewing the message.

Actual behavior

• As the owner, all images load fine.
• As the delegated user, every single proxied image request fails with 400 Bad Request. This affects all images in the message (logos, product images, tracking pixels/gifs, footer images) — not just specific ones.

Example failing request URL (sanitized):

GET https://cloud.example.tld/apps/mail/proxy?id=259324&hmac=<hmac>&src=https://example.com/assets/newsletter/.../image.png
=> 400 Bad Request

Response headers observed via browser devtools (relevant excerpt):

Status: 400 Bad Request
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Server: nginx
X-User-Id: <delegated_user_login>

Note the X-User-Id header reflects the delegated user's login, not the mailbox owner's account. This is consistent across all failing image requests in the message, and matches the console log pattern where every proxied image URL for the same message returns 400 exclusively when accessed by the delegate.

Mail app version

5.10.11

Nextcloud version

34.0.0

Mailserver or service

Mailcow

Operating system

No response

PHP engine version

No response

Nextcloud memory caching

Redis

Web server

Apache (supported)

Database

PostgreSQL

Additional info

No response

Start at the Mail app's /apps/mail/proxy entry point and reproduce the request with both the mailbox owner and delegated user. Compare authorization and mailbox access handling for the two accounts; done means proxied images load successfully for delegated users without changing owner behavior.