authenticator lost supautils from session_preload_libraries - dashboard-only fix, blocked on Elazar

Config drift confirmed on mars by db-mars-cc 2026-09-28: the authenticator role has session_preload_libraries=safeupdate only, while the cluster file default is supautils. ALTER ROLE is not additive, so authenticator sessions genuinely run without supautils hooks. venus and terra/enamel both read "supautils, safeupdate" (measured 03:45Z and 04:06Z), so mars is the outlier. NO AGENT CAN FIX THIS. session_preload_libraries is absent from supautils.privileged_role_allowed_configs (the list covers log_*, pgaudit.*, pgrst.*, safeupdate.enabled and similar), so ALTER ROLE is permission-denied even as postgres. The Management API endpoints config/database/postgres and postgres/config do not expose it. Dashboard-only. Restoring it needs Elazar in the Supabase console. CONTAINMENT, two independent reasons this is drift and not a live exposure. First, db-mars-cc read the Mars app code: zero .from() or PostgREST table calls anywhere, and all supabase-js usage is admin.auth.admin.* against the GoTrue Admin API, which is a separate service that never touches authenticator or PostgREST. Second, and this holds even if app code changed tomorrow: authenticator is only reachable through PostgREST, and mars PostgREST now resolves pgrst_no_exposed_schemas, which is deliberately EMPTY. Measured directly - a REST probe with the publishable key returns 404 PGRST205 "Could not find the table pgrst_no_exposed_schemas.<name>", so there is no table reachable by that role at all. So the exposure is gated twice over and the priority is correctness of configuration, not incident response. It should still be fixed, because the next person to enable the Data API on mars would silently be doing it on a cluster whose authenticator has no supautils guardrails, and that is exactly the kind of latent condition that looks fine until it does not. FIX: in the Supabase dashboard for project ustenjufophwhlkzfdso, restore authenticator session_preload_libraries to "supautils, safeupdate" to match the rest of the fleet. Verify after with: select array_to_string(rolconfig, chr(32)) from pg_roles where rolname = (quote)authenticator(quote).