feat: Supabase Anonymous Auth + JWT for chat endpoint

[WSlag]

Summary

Replace shared-API-key + �dmin=True database access with Supabase Anonymous Auth + JWT.

Changes

• api/auth.py - Added �erify_jwt() dependency (validates Bearer token via supabase.auth.get_user())
• api/main.py - /chat requires JWT, removed user_id from request body, CORS uses configurable origin
• api/chat_v2.py - user_id required param (no default), validation from JWT guarantee
• api/apply.py - Client-side Supabase anonymous auth, sends JWT in Authorization header
• 3 repositories - Switched from �dmin=True (service_role) to �dmin=False (anon key) for RLS enforcement
• schema.sql + migration - RLS policies changed from current_setting('app.user_id') to �uth.uid()
• Tests - 104/104 passing, new JWT auth test cases

How It Works

1. User clicks "Chat with Sara" ? browser calls supabase.auth.sign_in_anonymously()
2. Supabase returns a JWT ? browser stores it in localStorage
3. Each chat request includes Authorization: Bearer
4. Backend validates JWT, extracts user_id from sub claim
5. Repositories use anon key ? RLS enforces per-user row access