Replace URL-only images with first-class uploads using Supabase Storage as the priority backend, while keeping the abstraction S3-compatible for future Garage/S3 migration. Supports org logos, user avatars, changelog images, docs images, post/comment attachments, support ticket attachments, and OpenGraph assets.

Implementation: storage buckets with RLS policies, signed upload URLs, server-side MIME validation, max-size limits, image resizing to WebP/AVIF variants, virus/malware scanning hook, metadata table for ownership and usage, automatic cleanup of orphaned uploads, and drag/drop UI. Keep remote URL input as an escape hatch but make upload the primary path.