The bucket-level check is easy to miss when the error sounds like a table policy. Testing one upload as the signed-in user, not as a service key, usually shows which policy is actually blocking it.