-- The documents feature stores public file URLs for the 'files' bucket,
-- so the bucket itself must be public for downloads/previews to work.
UPDATE storage.buckets
SET public = true
WHERE id = 'files';

DROP POLICY IF EXISTS "Public can read files bucket" ON storage.objects;
CREATE POLICY "Public can read files bucket"
ON storage.objects
FOR SELECT
TO anon
USING (bucket_id = 'files');