M0: DB schema, RLS policies, JWT claims hook, seed, Supabase clients

Adds db/schema.sql (12 tables), db/policies.sql (RLS on all 12,
audit_log append-only), db/auth-hook.sql (role/org_id into JWT per
AD-2), db/seed.sql (org + 3 departments, part 2 deferred to M1 auth).
Wires lib/supabase/{client,server,service}.ts per AD-3 and adds
/db-check page confirming DB connectivity and RLS deny-by-default.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FcktbLXSSXzx23GCue813e

db/seed.sql

@@ -0,0 +1,50 @@
+-- Seed data
+-- Source: docs/04-database-schema.md section 4:
+--   "One org ('<Your Company>'), 3 departments (Inbound, Outbound, Admin),
+--    the founder as admin, 2 test staff, 2 sample SOPs (one draft, one
+--    published v1.0 with BM translation), a few acknowledgements —
+--    enough for the dashboard to show real numbers on day one."
+--
+-- NOTE: profiles.id references auth.users(id). Auth users don't exist yet
+-- (M1 builds login/signup). Part 1 below is safe to run now (M0). Part 2
+-- is provided for later — after M1 creates real auth users via Supabase
+-- Auth, replace the placeholder UUIDs with their real auth.users ids and
+-- run it then. Do not run Part 2 yet.
+
+-- ============================================================
+-- Part 1 — safe to run now (no auth dependency)
+-- ============================================================
+
+insert into orgs (id, name)
+values ('00000000-0000-0000-0000-000000000001', 'Demo Warehouse Co');
+
+insert into departments (id, org_id, name) values
+  ('00000000-0000-0000-0000-000000000011', '00000000-0000-0000-0000-000000000001', 'Inbound'),
+  ('00000000-0000-0000-0000-000000000012', '00000000-0000-0000-0000-000000000001', 'Outbound'),
+  ('00000000-0000-0000-0000-000000000013', '00000000-0000-0000-0000-000000000001', 'Admin');
+
+-- ============================================================
+-- Part 2 — run after M1 (auth users exist). Replace the id values
+-- below with the real auth.users.id for each account.
+-- ============================================================
+
+-- insert into profiles (id, org_id, full_name, role, department_id, preferred_language) values
+--   ('<founder-auth-user-id>', '00000000-0000-0000-0000-000000000001', 'Founder Name', 'admin', '00000000-0000-0000-0000-000000000013', 'en'),
+--   ('<staff-1-auth-user-id>', '00000000-0000-0000-0000-000000000001', 'Staff One', 'staff', '00000000-0000-0000-0000-000000000011', 'ms'),
+--   ('<staff-2-auth-user-id>', '00000000-0000-0000-0000-000000000001', 'Staff Two', 'staff', '00000000-0000-0000-0000-000000000012', 'en');
+
+-- insert into sops (id, org_id, code, title, department_id, category, owner_id, status, review_months, draft_content, created_by) values
+--   ('00000000-0000-0000-0000-000000000021', '00000000-0000-0000-0000-000000000001', 'WH-PICK-001', 'Order Picking', '00000000-0000-0000-0000-000000000012', 'Warehouse', '<founder-auth-user-id>', 'draft', 12, '{}'::jsonb, '<founder-auth-user-id>'),
+--   ('00000000-0000-0000-0000-000000000022', '00000000-0000-0000-0000-000000000001', 'WH-INB-001', 'Inbound Receiving', '00000000-0000-0000-0000-000000000011', 'Warehouse', '<founder-auth-user-id>', 'published', 12, '{}'::jsonb, '<founder-auth-user-id>');
+
+-- insert into sop_versions (id, org_id, sop_id, version_label, content, published_by) values
+--   ('00000000-0000-0000-0000-000000000031', '00000000-0000-0000-0000-000000000001', '00000000-0000-0000-0000-000000000022', '1.0', '{"purpose":"...","steps":[]}'::jsonb, '<founder-auth-user-id>');
+
+-- update sops set current_version_id = '00000000-0000-0000-0000-000000000031', published_at = now()
+--   where id = '00000000-0000-0000-0000-000000000022';
+
+-- insert into sop_translations (org_id, sop_version_id, language, content, machine) values
+--   ('00000000-0000-0000-0000-000000000001', '00000000-0000-0000-0000-000000000031', 'ms', '{"purpose":"...","steps":[]}'::jsonb, true);
+
+-- insert into acknowledgements (org_id, sop_version_id, user_id, language_viewed, typed_name) values
+--   ('00000000-0000-0000-0000-000000000001', '00000000-0000-0000-0000-000000000031', '<staff-1-auth-user-id>', 'ms', 'Staff One');