key_store: try both Supabase download endpoint forms for robustness

app/services/key_store.py

@@ -160,14 +160,23 @@ def load_config(tag: str) -> Optional[dict]:
     """
     if not (is_configured() and tag):
         return None
-    try:
-        url = f"{_base_url()}/storage/v1/object/{_BUCKET}/{_object_path(tag)}"
-        status, body = _http("GET", url, _auth_headers())
-        if not (200 <= status < 300) or not body:
-            return None
-        return decrypt_payload(tag, body)
-    except Exception:  # noqa: BLE001 - fail-safe
-        return None
+    obj = _object_path(tag)
+    # Supabase exposes private downloads at two equivalent paths depending on
+    # version; try the authenticated form first, then the plain one.
+    candidates = (
+        f"/storage/v1/object/authenticated/{_BUCKET}/{obj}",
+        f"/storage/v1/object/{_BUCKET}/{obj}",
+    )
+    for path in candidates:
+        try:
+            status, body = _http("GET", f"{_base_url()}{path}", _auth_headers())
+        except Exception:  # noqa: BLE001 - fail-safe; try the next candidate
+            continue
+        if 200 <= status < 300 and body:
+            payload = decrypt_payload(tag, body)
+            if payload is not None:
+                return payload
+    return None
 
 
 def delete_config(tag: str) -> bool: