Sub-ticket of PLUTO-374 Supabase legacy JWT key migration — anon/service_role → sb_publishable_*/sb_secret_* before late-2026 hard cutoff. Mirror mars WI#197. Audit all uses of NEXT_PUBLIC_SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY across env vars, edge functions, and any --no-verify-jwt paths. Ensure no secret-key leak to browser; Authorization header rules; Realtime 24h cap implications. · pluto