Storage policies for submissions read/insert and deliveries read were using
get_my_company_id() (single company) instead of has_company_access() — blocked
multi-company clients from uploading or viewing files.
NewRequest: delete task+submission if any file upload fails so no orphaned
records are left behind.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Krao Hasanee