feat(backend): add SupabaseStorage adapter (replaces R2 dependency)

Cloudflare R2 requires a credit card to enable on the account, blocking
provisioning. Supabase Storage already exists in the same project and
satisfies the same interface (upload_file, delete, public_url). Trades
10GB R2 free tier for 1GB Supabase, which still covers v1 traffic and
just accelerates the planned LRU eviction work to v1.5.

R2Storage class kept in place for a future migration.

storage.py

@@ -1,5 +1,34 @@
 from pathlib import Path
 import boto3
+from supabase import Client
+
+
+class SupabaseStorage:
+    """Storage adapter backed by Supabase Storage. Same interface as R2Storage."""
+
+    def __init__(self, *, client: Client, bucket: str, public_base_url: str):
+        self.bucket = bucket
+        self.public_base_url = public_base_url.rstrip("/")
+        self._client = client
+
+    def upload(self, data: bytes, key: str, *, content_type: str = "application/octet-stream") -> None:
+        self._client.storage.from_(self.bucket).upload(
+            path=key, file=data,
+            file_options={"content-type": content_type, "upsert": "true"},
+        )
+
+    def upload_file(self, path: Path, key: str, *, content_type: str = "audio/mpeg") -> None:
+        with open(path, "rb") as f:
+            self._client.storage.from_(self.bucket).upload(
+                path=key, file=f.read(),
+                file_options={"content-type": content_type, "upsert": "true"},
+            )
+
+    def delete(self, key: str) -> None:
+        self._client.storage.from_(self.bucket).remove([key])
+
+    def public_url(self, key: str) -> str:
+        return f"{self.public_base_url}/{key}"
 
 
 class R2Storage:

tests/test_storage.py

@@ -48,3 +48,49 @@ def test_upload_file_streams_from_path(mock_boto, tmp_path):
 def test_public_url_composes_base_and_key():
     storage = _make_storage()
     assert storage.public_url("karaoke/abc.mp3") == "https://pub.example.com/karaoke/abc.mp3"
+
+
+# --- SupabaseStorage ---------------------------------------------------------
+
+from storage import SupabaseStorage
+
+
+def _make_supabase_storage():
+    client = MagicMock()
+    storage = SupabaseStorage(
+        client=client, bucket="karaoke",
+        public_base_url="https://x.supabase.co/storage/v1/object/public/karaoke",
+    )
+    return storage, client
+
+
+def test_supabase_upload_calls_storage_from_upload():
+    storage, client = _make_supabase_storage()
+    storage.upload(b"data", "abc.mp3", content_type="audio/mpeg")
+    client.storage.from_.assert_called_with("karaoke")
+    client.storage.from_.return_value.upload.assert_called_once()
+    kwargs = client.storage.from_.return_value.upload.call_args.kwargs
+    assert kwargs["path"] == "abc.mp3"
+    assert kwargs["file"] == b"data"
+    assert kwargs["file_options"]["content-type"] == "audio/mpeg"
+
+
+def test_supabase_upload_file_reads_path(tmp_path):
+    storage, client = _make_supabase_storage()
+    p = tmp_path / "x.mp3"
+    p.write_bytes(b"abc")
+    storage.upload_file(p, "abc.mp3")
+    client.storage.from_.return_value.upload.assert_called_once()
+    kwargs = client.storage.from_.return_value.upload.call_args.kwargs
+    assert kwargs["file"] == b"abc"
+
+
+def test_supabase_public_url():
+    storage, _ = _make_supabase_storage()
+    assert storage.public_url("abc.mp3") == "https://x.supabase.co/storage/v1/object/public/karaoke/abc.mp3"
+
+
+def test_supabase_delete_calls_remove():
+    storage, client = _make_supabase_storage()
+    storage.delete("abc.mp3")
+    client.storage.from_.return_value.remove.assert_called_once_with(["abc.mp3"])