Sub-ticket of MARS-245 Migrate from legacy Supabase anon/service_role JWT keys to new sb_publishable_* + sb_secret_* (deadline late-2026); audit Authorization-header usage · mars