fix: append apikey to public storage URLs for Kong gateway access

Kong requires the apikey query param for public object access via img tags.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/SupabaseStorage.php

@@ -77,7 +77,7 @@ class SupabaseStorage
 
     public function getPublicUrl(string $bucket, string $path): string
     {
-        return SUPABASE_URL . "/storage/v1/object/public/{$bucket}/{$path}";
+        return SUPABASE_URL . "/storage/v1/object/public/{$bucket}/{$path}?apikey=" . SUPABASE_ANON_KEY;
     }
 
     public function getSignedUrl(string $bucket, string $path, int $expiresIn = 3600): string