fix: call update_s3_acls after karaoke track upload

All three karaoke upload paths (single product upload, async backfill,
CLI backfill script) now call update_s3_acls after writing tracks to S3,
ensuring karaoke track ACLs match the product's current visibility.

make_post_sell/lib/karaoke.py

@@ -475,6 +475,7 @@ def backfill_karaoke_async(shop_id, session_factory, app_settings):
                         product.file_bytes = tmp
                         session.add(product)
                         session.commit()
+                        product.update_s3_acls(s3, bucket)
                         log.info("  OK %s (inst=%dB, vox=%dB)", title, sizes["instrumentals"], sizes["vocals"])
                     else:
                         log.warning("  FAILED %s after %d attempts", title, MAX_RETRIES)

make_post_sell/scripts/backfill_karaoke.py

@@ -70,6 +70,7 @@ def backfill(env, dry_run=True):
                 product.file_bytes = tmp
                 dbsession.add(product)
                 dbsession.flush()
+                product.update_s3_acls(s3, bucket)
                 print(f"  OK (instrumentals: {sizes['instrumentals']}B, vocals: {sizes['vocals']}B)")
                 processed += 1
             else:

make_post_sell/views/product.py

@@ -390,6 +390,7 @@ def product_edit(request):
                 product.file_bytes = tmp
                 request.dbsession.add(product)
                 request.dbsession.flush()
+                product.update_s3_acls(request.secure_uploads_client, request.app["bucket.secure_uploads"])
 
         # redirect back to this page to clear
         # the params posted by the s3 webhooks.