[Gap-Audit] gdpr-compliance.spec.ts:126 fails with ENOTFOUND scripthammer-supabase-kong-1

[TortoiseWolfe]

Symptom

Running the messaging E2E suite against Cloud Supabase (the project's normal config), tests/e2e/messaging/gdpr-compliance.spec.ts:126 "GDPR Data Export › should export decrypted messages (T191)" fails:

```
[cause]: Error: getaddrinfo ENOTFOUND scripthammer-supabase-kong-1
```

Why this looks pre-existing

`scripthammer-supabase-kong-1` is the local self-hosted Supabase Kong gateway hostname (Docker compose internal — see `docker-compose.yml` Supabase profile). The project normally targets Cloud Supabase at `https://huvitqubafsrazpjxsax.supabase.co\`.

Something in the GDPR data-export flow (probably the Storage download URL) ends up referring to the local Kong host instead of Cloud Supabase. Nothing in `src/` or `supabase/` hard-codes `scripthammer-supabase-kong-1` per `grep` — likely an env var or Storage public-URL construction path that hasn't been updated since the local→Cloud switch.

Repro

1. `docker compose up` (Cloud Supabase config in `.env`)
2. `docker compose exec scripthammer pnpm exec playwright test --project=chromium-msg tests/e2e/messaging/gdpr-compliance.spec.ts:126`

Notes

• All other tests in the messaging suite pass (67/77 in the full chromium-msg run from batch 7c follow-up; the rest are conditional skips, no other failures).
• This is not related to the encryption migration shipped in batch 7c ([Gap-Audit] Security: crypto/secrets hygiene across messaging + audit logging #12 C).
• The test downloads a JSON via the "Download My Data" button, then asserts message contents are decrypted plaintext. The DNS error happens during the download step.

Suggested investigation

1. `grep -r "kong|scripthammer-supabase" supabase/ src/services/messaging/gdpr-service.ts` — find the construction site
2. Check Supabase Storage public URL format (is the export uploaded to Storage and signed-URL'd back?)
3. If the local kong reference comes from a stale Storage URL stored in a DB row, may need a one-time data fix