Remove unused frontend Supabase helper and add backend startup guard

The frontend was carrying a server-side Supabase helper it didn't need, and its env documentation referenced the service-role secret key - a credential that has no business near the browser tier. Both are gone. The intent is to make the trust boundary visible in the code: service-role access is backend-only, and the frontend configuration shouldn't suggest otherwise.

On the backend, the server-side Supabase client now checks for its required credentials at startup and throws if they're absent. Previously, a misconfigured deploy would boot without complaint and then produce confusing errors on the first Supabase call. The guard converts that late failure into an early, obvious one.

Small change overall. Dead code removal, narrowed env documentation, one guard added at credential-consumption time. Build checks on both tiers were the stated verification.