Fix content access gaps for anonymous and public document users

[BigSimmo]

Summary

Reviewed the repo's content access model and fixed several gaps that blocked legitimate users from reaching public content.

Access model (current)

• Authenticated users see only their own documents (owner_id = auth.uid()), enforced at both API and RLS layers.
• Anonymous users can search/answer against public documents (owner_id IS NULL), plus curated static snapshots for services, forms, medications, and differentials.
• Private mutations (upload, reindex, labels, delete) remain auth-required.

Issues found and fixed

1. Invalid/expired bearer tokens returned 401 on search/answer/registry routes instead of degrading to anonymous public scope — this caused the UI error "Search request was not authorized by the server."
2. Registry routes parsed auth even when no auth signal was present, unlike medications/differentials — stale tokens could 401 instead of serving the public snapshot.
3. Document preview routes required sign-in even for public documents — anonymous users could get search hits but could not open PDFs or document detail.
4. DocumentViewer blocked all source loading unless signed in — now loads public sources when the project is ready.

Security preserved

• Anonymous document reads are scoped to owner_id IS NULL only (no cross-tenant leakage).
• Authenticated reads remain owner-scoped.
• Upload and mutation routes unchanged (still require auth).

Verification

• npm run verify:cheap (118 test files, 1060 tests passed)
• npm run verify:ui — DocumentViewer behavior changed; recommend UI gate before merge
• npm run check:production-readiness — touches document access and auth flows

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow introduced
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains separated from real clinical sources
• Anonymous access limited to explicit public documents and curated snapshots

Follow-up (not in this PR)

• Ensure production has documents with owner_id IS NULL if anonymous search should return real indexed content (currently most uploads assign an owner).
• Optional PUBLIC_WORKSPACE_OWNER_ID for anonymous uploads (planned in docs/superpowers/plans/2026-07-04-public-anonymous-access-rate-limits.md).
• Live two-user RLS integration test still outstanding per docs/clinical-governance.md.

  

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[BigSimmo]

Superseded by #269 (consolidated platform fixes branch).