Disable GoTrue email/password provider (external_email_enabled)

Fleet-wide finding: Supabase factory default ships external_email_enabled=true on every project, never inspected until tonight's enamel Site-URL sweep. Mars auth is genuine-Google-only in the app UI but the provider was live at the API level — anyone could call signUp/signInWithPassword directly. pmmaster Class-A APPROVED, audit-unavailable waiver. Fixed with MARS-569-pattern discipline: single-key PATCH on external_email_enabled only, not built from GET, independent before/after reads, field-select, secret untouched. disable_signup deliberately left untouched (server-wide across all providers, would block legit Google sign-in).