Self-hosted Supabase Kong requires apikey param even for public bucket
URLs. Without it, browsers get 401 when loading the image.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>