Phase 2: migrate tabular.ts onto pg, drop @supabase/supabase-js

Closes the final backend route on Supabase JS. 1733-line tabular.ts
with 49 PostgREST query sites converted to parameterised SQL.

Highlights:
- GET / collapses three Supabase queries (own + shared-by-project +
  shared-by-email) into the same pattern used elsewhere
  (shared_with @> $::jsonb). Per-review cell count now uses a single
  SELECT COUNT(DISTINCT document_id) GROUP BY review_id instead of
  N round trips.
- POST / and PATCH /:reviewId build the bulk tabular_cells insert
  with multi-row VALUES positional placeholders, same shape as the
  edits insert in chatTools.
- /:reviewId/people drops db.auth.admin.listUsers({ perPage: 1000 })
  in favour of a single SELECT id, lower(email::text), display_name
  FROM users WHERE lower(email::text) = ANY($1::text[]). No more
  Supabase Auth admin dependency anywhere in the backend.
- Streaming /:reviewId/generate writes all status transitions and
  cell content through parameterised UPDATE. The cell-update SSE
  events are unchanged.

Dependency removal:
- backend/src/lib/supabase.ts deleted.
- Every ReturnType<typeof createServerSupabase> type alias collapsed
  to `unknown`. Affected files: lib/access.ts, lib/userApiKeys.ts,
  lib/userSettings.ts, lib/documentVersions.ts, lib/chatTools.ts,
  routes/projects.ts. The aliases were transitional only.
- @supabase/supabase-js uninstalled from backend/package.json.

End-to-end verification against Postgres 16:
- tabular: POST create, GET list, GET detail, GET people (owner
  display_name + member display_name), PATCH rename, GET chats,
  DELETE returning 204.
- Full regression sweep: /chat, /projects, /workflows,
  /single-documents, /user/profile all still return the expected
  shapes and 2xx codes.

The backend no longer depends on the Supabase JS client at all.
Auth is Auth.js (HS256 JWT verification via jose); data access is
plain pg with parameterised SQL.

Remaining for Phase 2:
- M1 (account-deletion teardown of storage objects + re-auth
  confirmation).
- Frontend Supabase dependencies (frontend already migrated, but
  may have stray imports to audit).