[davidvanleeuwen]

✨ What changes

Ordinary Scaleway bucket synchronization no longer installs a bucket-wide public-read policy, which could override private object ACLs. Storage sync failures also no longer abort an enclosing database transaction when the caller handles the error and continues.

• Update CORS without reading, replacing or deleting policies on Scaleway when hotlink protection is disabled.
• Preserve explicit policies for protected media and existing behavior for other storage providers.
• Keep the row lock and returned storage errors; add regressions for policy-free synchronization and usable outer transactions.
• Update locked Ecto to 3.14.3 to resolve CVE-2026-118391, which blocked the dependency audit.

🔎 Additional checks

An isolated API creation scenario completed with an API key using only bucket HEAD and CORS requests, with no policy request. The earlier simulated HTTP 400 scenario also succeeds after the transaction fix. No live storage settings were changed.