Only an account explicitly authorized in Supabase can manage content.
Large files upload directly to R2 using a short-lived signed URL. Keep R2 private unless you deliberately configure a secure public delivery domain. The app's playback URL must match your R2 delivery setup.