R2 storage from env + filename normalization

src/modules/storage/buildR2Storage.ts

@@ -46,9 +46,24 @@ export const buildR2Storage = (collections: string[] = ['media']): Plugin => {
     collectionsConfig[slug] = true
   }
 
+  // Public URL for served media. R2 is private by default; with a custom domain
+  // (media.klient.pl → bucket) set R2_PUBLIC_URL so Payload generates URLs
+  // pointing there instead of the private S3 endpoint (which 403s on the front).
+  // Without it, uploads work but images don't display publicly. See docs/storage.md.
+  const publicUrl = process.env.R2_PUBLIC_URL?.replace(/\/$/, '') // strip trailing slash
+
   return s3Storage({
     bucket,
     collections: collectionsConfig,
+    ...(publicUrl
+      ? {
+          // generateFileURL overrides the stored/returned URL to the CDN domain.
+          // Params come from Payload's storage plugin; type them explicitly since
+          // the callback shape isn't inferred here (would be implicit any).
+          generateFileURL: ({ filename, prefix }: { filename: string; prefix?: string }) =>
+            [publicUrl, prefix, filename].filter(Boolean).join('/'),
+        }
+      : {}),
     config: {
       credentials: { accessKeyId, secretAccessKey },
       endpoint,