marklok takes user data out of the browser's hands

Until now, this fork let the browser read and update user profiles directly against Supabase, the hosted database service behind Mike, trusting database-level rules to block anything it shouldn't touch. marklok has moved that traffic behind two authenticated backend endpoints, with a strict list of which fields a user is actually allowed to change. Anything off the list is quietly ignored - a real tightening over the old setup.

Two gaps are worth watching before anyone leans on this. Stored AI API keys now pass through the update path, where they could land in server logs unless something scrubs them, and the field tracking a user's used message credits is still writable by the user - so in principle someone could reset their own meter. Neither is clearly defended in what's visible. The bigger signal: marklok looks to be steadily routing all direct browser-to-database access through the backend.