Bind cross-project media signing to its original storage source

When database copies retain media URLs from another Supabase project, routing only URLs from the current project leaves those files on their old public path. Supporting the additional origin requires source-aware metadata and signing, not just a broader hostname check. Keep application-record permissions in the current database, but read the object's original creation time and issue its signed URL using the exact source project's credentials. Fail closed when those credentials are absent. Keep source origins explicitly allowlisted and credentials server-only. This applies to authorized cross-project references; it does not itself grant permission to expose production storage to test environments.

Applies when: Staging or preview records reference files retained in another storage project. Keywords: Supabase signed URLs cross-project staging preview origin metadata expiry credentials