Verify payment proof bucket RLS and signed URL access

[Taleef7]

Context

Payment proof security was marked resolved in the gap analysis, but the pre-launch checklist still calls for direct verification of bucket RLS and signed URL behavior.

Acceptance criteria

• Confirm payment proofs are not publicly readable.
• Confirm students can access only their own proof via signed URL flow.
• Confirm admins can view submitted proofs through the admin UI.
• Confirm rejected-payment re-upload continues to work.
• Add/update tests where practical, or document manual verification steps and results.

References

• docs/GAP_ANALYSIS.md A1/D5
• docs/plan-CorvEd.md Step 6 pre-launch checklist