File Storage Security

All uploads use private Supabase Storage.

• No public URLs — signed URLs only
• Expire after 1 hour
• Widget: verified via session token
• Dashboard: verified via auth cookie
• Cross-conversation access blocked