storage-uploadslisted

# Storage Uploads Documents and attachments go through object storage via signed URLs — large files through a serverless function risk payload/timeout limits. ## Pattern 1. Server handler authorizes caller, then issues signed **upload** URL scoped to path convention (e.g. `documents/{entity_id}/{uuid}-{filename}`). 2. Client uploads directly to storage using signed URL — bytes never pass through app server. 3. Second handler records file metadata (path, uploaded_by, owning entity) after upload — storage and DB are separate writes. 4. Reads use signed **download** URLs minted on demand after authorization check. ## Rules - Buckets private by default; every read/write via signed URL after permission check - Path convention includes owning entity id for authorization - Signed URLs short-lived — store permanent storage path, not signed URL Cursor equivalent: `.cursor/rules/storage-uploads.mdc`