fix: upload branding assets to Supabase Storage instead of local filesystem

Local uploads were unreachable by the player app on a different domain.
Now uploads go to profile-images/branding/ bucket with upsert, producing
a full public URL that the player app can load directly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

modules/branding/controller.php

@@ -78,11 +78,34 @@ class BrandingController
         }
 
         $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
-        $filename = $id . '_' . time() . '.' . $ext;
-        $dest = STORAGE_PATH . '/uploads/' . $filename;
-        move_uploaded_file($file['tmp_name'], $dest);
+        $filename = $id . '.' . $ext;
+        $storagePath = 'branding/' . $filename;
+
+        $fileContents = file_get_contents($file['tmp_name']);
+        $storageUrl = SUPABASE_URL . '/storage/v1/object/profile-images/' . $storagePath;
+
+        $ch = curl_init($storageUrl);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT');
+        curl_setopt($ch, CURLOPT_POSTFIELDS, $fileContents);
+        curl_setopt($ch, CURLOPT_HTTPHEADER, [
+            'Authorization: Bearer ' . SUPABASE_SERVICE_KEY,
+            'Content-Type: ' . $file['type'],
+            'x-upsert: true',
+        ]);
+        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
+        $result = curl_exec($ch);
+        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        curl_close($ch);
+
+        if ($httpCode >= 400) {
+            Response::error('فشل رفع الملف إلى التخزين: ' . ($result ?: $httpCode), '/branding');
+            return;
+        }
+
+        $assetUrl = SUPABASE_URL . '/storage/v1/object/public/profile-images/' . $storagePath
+            . '?apikey=' . SUPABASE_ANON_KEY . '&v=' . time();
 
-        $assetUrl = '/storage/uploads/' . $filename;
         $this->db->update('platform_assets', ['id' => "eq.{$id}"], [
             'asset_url' => $assetUrl,
             'updated_at' => date('c'),