How are you handling S3 media delivery in FluentCommunity without CDN/custom domain support?

I’m currently testing S3 storage for FluentCommunity and would like to understand how others are handling the practical limitations of the current setup.

At the moment, FluentCommunity stores and serves media directly from the S3-compatible storage URL. This works technically, but it raises a few questions for production use:

• public S3 URLs can be accessed directly outside the website;
• repeated or abusive downloads may generate additional storage traffic;
• CORS does not really solve direct access or hotlinking;
• there doesn’t seem to be a built-in way to serve FluentCommunity media through a CDN or a custom domain such as media.example.com;
• using a private bucket with signed URLs also doesn’t appear to be supported as a standard FluentCommunity workflow.

For those already running FluentCommunity with S3 in production:

1. Do you simply use the public S3 URLs directly?
2. How do you deal with hotlinking or potentially abusive traffic?
3. Have you found a reliable way to place a CDN or custom domain in front of the S3 bucket without modifying FluentCommunity core files?
4. Are there any recommended architectures for larger communities where media traffic may become significant?

And a question for the FluentCommunity team:

Is native support for a custom media domain / CDN in front of S3 planned for FluentCommunity?

Ideally, it would be useful to keep S3 as the origin while allowing FluentCommunity to generate media URLs such as:

https://media.example.com/...

instead of exposing the storage provider’s S3 URL directly.

It would be interesting to hear both how the community handles this today and whether this is on the product roadmap.