Phase 2: migrate lib helpers off Supabase JS onto pg

Begins the route-migration sub-phase by converting the four lib
helpers that every route depends on. Helper signatures keep their
db parameter as optional and ignored so callers compile unchanged;
they get cleaned up once each calling route migrates.

  src/lib/access.ts          checkProjectAccess, ensureDocAccess,
                             ensureReviewAccess,
                             filterAccessibleDocumentIds,
                             listAccessibleProjectIds. Switched to
                             pg queries. listAccessibleProjectIds
                             now uses the @> JSONB containment
                             operator on shared_with (the PostgREST
                             cs equivalent), still parameterised.

  src/lib/userApiKeys.ts     getUserApiKeyStatus, getUserApiKeys,
                             saveUserApiKey. Insert/upsert/delete
                             now via parameterised SQL with ON
                             CONFLICT (user_id, provider).

  src/lib/userSettings.ts    getUserModelSettings, getUserApiKeys.
                             tabular_model preference now read with
                             a single parameterised SELECT against
                             user_profiles.

  src/lib/documentVersions.ts loadActiveVersion,
                             attachActiveVersionPaths,
                             attachLatestVersionNumbers. The
                             attach* helpers use ANY($1::uuid[]) for
                             batched lookups.

End-to-end verified against the Phase 2 schema in Postgres 16:
  - saveUserApiKey upsert and delete behave correctly;
    AES-256-GCM round-trip is intact (sk-test-abc-123-xyz saved
    encrypted and decrypted back identically).
  - getUserApiKeyStatus surfaces 'user' / null sources correctly.
  - listAccessibleProjectIds returns empty for a user with no
    projects.
  - checkProjectAccess returns {ok:false} for a non-existent
    project id.
  - Backend still boots, /ready returns ok, /auth/verify-credentials
    signs in an existing user with the previously-reset password.

Routes still use the Supabase JS client for their own queries and
will migrate one or two at a time in the next commits.