Fix client storage RLS + rollback task on upload failure

Storage policies for submissions read/insert and deliveries read were using
get_my_company_id() (single company) instead of has_company_access() — blocked
multi-company clients from uploading or viewing files.

NewRequest: delete task+submission if any file upload fails so no orphaned
records are left behind.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

supabase/migrations/20260513160000_fix_client_storage_policies.sql

@@ -0,0 +1,45 @@
+-- Fix client storage policies to use has_company_access() instead of get_my_company_id().
+-- Previously, clients tied to multiple companies via company_members could not upload
+-- or read files for their non-primary company.
+
+drop policy if exists "Client reads submissions storage" on storage.objects;
+create policy "Client reads submissions storage" on storage.objects
+  for select to authenticated
+  using (
+    bucket_id = 'submissions'
+    and get_my_role() = 'client'
+    and split_part(name, '/', 1) in (
+      select t.id::text
+      from public.tasks t
+      join public.projects p on p.id = t.project_id
+      where has_company_access(p.company_id)
+    )
+  );
+
+drop policy if exists "Client inserts submissions storage" on storage.objects;
+create policy "Client inserts submissions storage" on storage.objects
+  for insert to authenticated
+  with check (
+    bucket_id = 'submissions'
+    and get_my_role() = 'client'
+    and split_part(name, '/', 1) in (
+      select t.id::text
+      from public.tasks t
+      join public.projects p on p.id = t.project_id
+      where has_company_access(p.company_id)
+    )
+  );
+
+drop policy if exists "Client reads deliveries storage" on storage.objects;
+create policy "Client reads deliveries storage" on storage.objects
+  for select to authenticated
+  using (
+    bucket_id = 'deliveries'
+    and get_my_role() = 'client'
+    and split_part(name, '/', 1) in (
+      select t.id::text
+      from public.tasks t
+      join public.projects p on p.id = t.project_id
+      where has_company_access(p.company_id)
+    )
+  );