[antosubash]

Fixes the four P3 observations from the browser QA of #551. Stacked on #551: the base is fix/bug-batch-517-548, so this diff shows only the follow-ups. Once #551 merges it retargets to main.

Changes

• Usage on the file storage browse page. A caller without file_storage.manage now sees only their own usage: one SUM scoped by created_by, with no tenant quota shown. They used to see the tenant-wide total, which disclosed other users' aggregate storage. Managers keep the tenant figure and quota.
• Authenticated download CSP. /api/file-storage/files/{id}/download now sends the same sandbox CSP as public serving, alongside attachment and nosniff. Both routes share the new serving.sandbox_headers(). The thumbnail route already sent it, and a test now pins it.
• Clearing a settings field. Saving a field's default, including clearing an optional field, deletes its override row instead of storing it, so the field reads "default" again. A save that resubmits the default also cleans up a legacy null row. Env-pinned fields are still refused first, and secrets are unwrapped before comparing.
• Inline settings errors. A field's validation error is now its own grid row below the control, not squeezed into the control's cell, where it wrapped one word per line.

Verification

• make lint, make test-js and the full Python suite pass: 4644 passed, 21 skipped.
• Browser-checked on a fresh install:
  • The quota error renders on one line below the input at 1280px and at 400px.
  • A cleared quota loses the "overridden" badge.
  • A member with no files sees "0 B used" with no quota; after uploading 19 B they see "19 B used"; the admin sees "1 KB of 1 MB used".
  • The member's download headers include attachment, nosniff and default-src 'none'; …; sandbox.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-19T08:11:13.901797Z	7d639f0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	7d639f0
Status:	✅  Deploy successful!
Preview URL:	https://7d5459a6.simple-module-python.pages.dev
Branch Preview URL:	https://fix-p3-followups-551.simple-module-python.pages.dev

View logs