fix: add missing apikey header to SupabaseStorage requests

Kong gateway requires the apikey header alongside Authorization.
Without it, storage uploads fail with "No API key found in request".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/SupabaseStorage.php

@@ -32,6 +32,7 @@ class SupabaseStorage
             CURLOPT_POST => true,
             CURLOPT_POSTFIELDS => $fileContent,
             CURLOPT_HTTPHEADER => [
+                'apikey: ' . $this->serviceKey,
                 'Authorization: Bearer ' . $this->serviceKey,
                 'Content-Type: ' . $mimeType,
                 'x-upsert: true',
@@ -61,6 +62,7 @@ class SupabaseStorage
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_CUSTOMREQUEST => 'DELETE',
             CURLOPT_HTTPHEADER => [
+                'apikey: ' . $this->serviceKey,
                 'Authorization: Bearer ' . $this->serviceKey,
             ],
             CURLOPT_TIMEOUT => 30,
@@ -89,6 +91,7 @@ class SupabaseStorage
             CURLOPT_POST => true,
             CURLOPT_POSTFIELDS => json_encode(['expiresIn' => $expiresIn]),
             CURLOPT_HTTPHEADER => [
+                'apikey: ' . $this->serviceKey,
                 'Authorization: Bearer ' . $this->serviceKey,
                 'Content-Type: application/json',
             ],