The View button for documents was constructing the href as API_HOST + file_path which resolved to http://localhost:3001/... Since the frontend is served from the same Express server, this should be a relative path. Users' browsers don't have localhost:3001 running, so the link was broken for anyone not on the server itself.