a37bcaa935
Pre-merge smoke caught a second issue: the source_file_id download path read `files` as-the-user, tripping a PRE-EXISTING broken RLS policy on cabinet_memberships (42P17 infinite recursion). Authz is already enforced (template fetch + source visibility), and source_file_id is the template's own file, so resolve the row via service role (documented exception, same as the catalogue lookup). Flagged the cabinet_memberships RLS recursion separately as infra bug E8. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>