fix: remove auth bypass dev fallback in getUserIdFromRequest

From the PR description

Summary

• Removes the dev fallback in getUserIdFromRequest() that accepted any Bearer token verbatim as a user ID when env vars were absent
• Missing NEXT_PUBLIC_SUPABASE_URL or SUPABASE_SECRET_KEY now throws a 500 response instead of silently bypassing authentication
• createServerSupabase() also now throws when env vars are missing instead of silently creating a client with empty credentials
• Removes redundant || "" fallbacks from getUserIdFromRequest for consistency
• Adds vitest and unit tests covering missing-env-var cases for both functions

Closes #65 Closes #87 Closes #89 Closes #90

Changes

• frontend/src/lib/supabase-server.ts - createServerSupabase throws on missing env vars; getUserIdFromRequest removes || "" fallbacks; bypass fallback replaced with throw new Response(..., { status: 500 })
• frontend/src/lib/__tests__/supabase-server.test.ts - 10 unit tests covering both createServerSupabase and getUserIdFromRequest
• frontend/vitest.config.ts - minimal vitest config

Test plan

• Unit tests added and passing (10/10)
• TypeScript clean
• Build requires real Supabase env vars (pre-existing prerender failure without credentials)