Meeting audio recordings uploaded to Supabase Storage with no documented encryption-at-rest or bucket ACL policy

## Problem

Meeting audio recordings (captured via the Vexa bot transcriber) are uploaded
to Supabase Storage. The project does not document:
- Whether the Storage bucket is private or public.
- What bucket-level access policies restrict who can read uploaded audio files.
- Whether recordings are encrypted at rest beyond Supabase's default (which
depends on the hosting region and plan).

If the bucket is accidentally set to public (a common Supabase misconfiguration),
anyone who discovers or guesses an audio file URL can download private meeting
recordings without authentication.

Meeting recordings contain highly sensitive business and personal information.
A data leak of this nature could have legal and compliance implications
(GDPR, CCPA).

## Suggested Fix

1. Verify in `BACKEND.md` that the meeting recordings bucket is set to
**private** in Supabase Storage, with no public access policy.
2. Add an RLS policy on the `storage.objects` table ensuring only the meeting
owner (matching `auth.uid()`) can read their own recordings.
3. Document the bucket configuration in `BACKEND.md` with step-by-step
instructions for contributors setting up the backend.
4. Add a setup verification step that checks bucket policies are correctly
configured before allowing the app to function.