Handle missing image objects properly

## Description

When the resolved S3 location is not present, the server throws an unhandled error and returns an `AccessDenied` response. Proper error responses should include:

- `404 Not Found` when the S3 object is missing
- `400 Bad Request` on a malformed request
- `500 Server Error` on an unknown/unhandled error