fix(tournaments): banners in the tournament list loaded without the storage key

The list built a tournament-media URL without ?apikey= when the public
helpers were not loaded; Kong refused it and every banner in the hub was a
broken image.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/tournaments.php

@@ -63,7 +63,9 @@ function tournamentSafeImage(?string $url): ?string {
 function tournamentPublicMediaUrl(?string $path): ?string {
     if (!$path || !str_starts_with($path, 'tournament-media/')) return null;
     if (function_exists('tournamentMediaUrl')) return tournamentMediaUrl($path);
-    return SUPABASE_URL . '/storage/v1/object/public/' . implode('/', array_map('rawurlencode', explode('/', $path)));
+    // Kong refuses a storage read without the anon key, public object or not:
+    // without it every banner in the list was a broken image.
+    return SUPABASE_URL . '/storage/v1/object/public/' . implode('/', array_map('rawurlencode', explode('/', $path))) . '?apikey=' . SUPABASE_ANON_KEY;
 }
 
 /** A register/withdraw answer for the client, with the HTTP status it deserves. */