fix(storage): make KVM /storage-write/ the primary path, not the optional dual-write fallback

Since the 2026-07-08 cutover, the Supabase qr-generations bucket has been
deleted. The dashboard was still trying it as the primary write and only
falling back to KVM when QRCUT_* env vars were set -- but those secrets
were never added to the Space, so every user generation since 2026-07-08
has produced a broken image (public_url points at the dead Supabase URL).

Changes:
- Try qrcut.co /storage-write/ FIRST. On HTTP 201, return the KVM URL
as public_url and skip the dead Supabase write entirely.
- Only fall back to the Supabase legacy path if KVM write fails or env
is missing. The legacy path will 404 in prod; that's logged.
- All other behaviour (presign, scans, OAuth, list_my_generations,
retention) unchanged.

hf_dashboard.py

@@ -216,25 +216,13 @@ def _png_bytes(image: Image.Image, *, max_size: int | None = None) -> bytes:
 
 def _upload_public_png(*, image: Image.Image, object_path: str, max_size: int | None = None) -> str:
     png_bytes = _png_bytes(image, max_size=max_size)
-    _ensure_bucket()
-    _request_bytes(
-        "POST",
-        f"/storage/v1/object/{GENERATIONS_BUCKET}/{urllib_parse.quote(object_path, safe='/')}",
-        data=png_bytes,
-        content_type="image/png",
-        headers={"x-upsert": "true"},
-    )
 
-    public_url = f"{SUPABASE_URL}/storage/v1/object/public/{GENERATIONS_BUCKET}/{object_path}"
-
-    # Optional dual-write to kvm9276 (qrcut.co) when QRCUT_* env vars are set.
-    # Failures here are logged but do NOT break the Supabase write -- Supabase
-    # remains the source of truth until the user explicitly deletes the bucket.
+    # Primary write path (since 2026-07-08 cutover): qrcut.co KVM via the
+    # nginx /storage-write/ proxy. This is the LIVE source of truth now that
+    # the Supabase qr-generations bucket is deleted. Failures fall through to
+    # the Supabase legacy path for safety, but in practice the legacy path
+    # always 404s today -- expect dual-write to win on every call.
     if QRCUT_STORAGE_URL and QRCUT_WRITE_API_KEY:
-        print(
-            f"[qrcut] dual-write enabled path={object_path} bytes={len(png_bytes)} target={QRCUT_STORAGE_URL}/storage-write/...",
-            flush=True,
-        )
         try:
             kvm_req = urllib_request.Request(
                 f"{QRCUT_STORAGE_URL}/storage-write/{urllib_parse.quote(object_path, safe='/')}",
@@ -251,28 +239,46 @@ def _upload_public_png(*, image: Image.Image, object_path: str, max_size: int |
             with urllib_request.urlopen(kvm_req, timeout=30) as kvm_resp:
                 if kvm_resp.status == 201:
                     public_url = f"{QRCUT_STORAGE_PUBLIC_URL}/storage/{object_path}"
-                    print(f"[qrcut] dual-write success HTTP 201: {object_path}", flush=True)
-                else:
-                    response_body = kvm_resp.read(400).decode("utf-8", errors="replace").strip()
                     print(
-                        f"[qrcut] dual-write HTTP {kvm_resp.status}: {object_path} body={response_body}",
+                        f"[qrcut] KVM primary write OK: {object_path} -> {public_url}",
                         flush=True,
                     )
-        except urllib_error.HTTPError as exc:
-            response_body = exc.read(400).decode("utf-8", errors="replace").strip()
+                    return public_url
+                response_body = kvm_resp.read(400).decode("utf-8", errors="replace").strip()
+                print(
+                    f"[qrcut] KVM primary write HTTP {kvm_resp.status}: {object_path} body={response_body} -- falling back to Supabase",
+                    flush=True,
+                )
+        except (urllib_error.HTTPError, urllib_error.URLError, TimeoutError, OSError) as exc:
             print(
-                f"[qrcut] dual-write failed HTTP {exc.code}: {exc.reason} body={response_body} -- {object_path}",
+                f"[qrcut] KVM primary write failed: {exc} -- {object_path} -- falling back to Supabase",
                 flush=True,
             )
-        except (urllib_error.URLError, TimeoutError, OSError) as exc:
-            print(f"[qrcut] dual-write failed: {exc} -- {object_path}", flush=True)
     else:
         print(
-            f"[qrcut] dual-write skipped missing env: storage_url={'yes' if QRCUT_STORAGE_URL else 'no'} write_key={'yes' if QRCUT_WRITE_API_KEY else 'no'} path={object_path}",
+            f"[qrcut] KVM primary write skipped missing env: storage_url={'yes' if QRCUT_STORAGE_URL else 'no'} write_key={'yes' if QRCUT_WRITE_API_KEY else 'no'} path={object_path}",
+            flush=True,
+        )
+
+    # Legacy / safety-net path: Supabase qr-generations bucket. Note: this
+    # bucket is deleted on the production project as of 2026-07-08, so this
+    # branch will 404 in practice. Kept for environments that still have it.
+    try:
+        _ensure_bucket()
+        _request_bytes(
+            "POST",
+            f"/storage/v1/object/{GENERATIONS_BUCKET}/{urllib_parse.quote(object_path, safe='/')}",
+            data=png_bytes,
+            content_type="image/png",
+            headers={"x-upsert": "true"},
+        )
+    except (urllib_error.HTTPError, urllib_error.URLError, TimeoutError, OSError) as exc:
+        print(
+            f"[qrcut] Supabase legacy write failed: {exc} -- {object_path} -- image WILL BE BROKEN for user",
             flush=True,
         )
 
-    return public_url
+    return f"{SUPABASE_URL}/storage/v1/object/public/{GENERATIONS_BUCKET}/{object_path}"
 
 
 def _session_oauth_info(request: Any | None) -> dict[str, Any]: