chore: deploy Phase 2A backend to live Supabase project (Task 9)

Substitutes the real admin UID everywhere the placeholder appeared,
points the Edge Functions base URL at the deployed project, and adds
production JWT verification: trigger functions now send the anon key
as a bearer token so verify_jwt can stay enabled instead of leaving
the functions open to unauthenticated calls from the public internet.

Also adds scripts/create-admin.ts (one-off helper used to create
Mira's admin auth user), documents the seed script's non-VITE env
vars in .env.example, and closes a gitignore gap where plain .env
wasn't excluded alongside .env.local.

Claude-Session: https://claude.ai/code/session_01NhxA4npAXAxmCDEJt6kxSH

supabase/migrations/20260808000003_notify_triggers.sql

@@ -59,7 +59,23 @@ returns text
 language sql
 immutable
 as $$
-  select 'http://host.docker.internal:54321/functions/v1'
+  select 'https://ylxppnclfpnnolnjkbwv.supabase.co/functions/v1'
+$$;
+
+-- The Edge Functions gateway enforces JWT verification (verify_jwt = true,
+-- see supabase/config.toml) in production, since these functions are
+-- reachable over the public internet and would otherwise let anyone trigger
+-- an outbound email send by POSTing directly to the URL. pg_net's request
+-- carries no Authorization header by default, so the trigger must supply
+-- one. The anon key is not a secret (it already ships in the frontend
+-- bundle), so embedding it here as a literal, single-source-of-truth
+-- constant is safe — the same pattern as edge_functions_base_url() above.
+create or replace function public.edge_functions_anon_key()
+returns text
+language sql
+immutable
+as $$
+  select 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InlseHBwbmNsZnBubm9sbmprYnd2Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODY0NTkyNzYsImV4cCI6MjEwMjAzNTI3Nn0.j0UaxlBvDctsDOXxPuWj43XvbObtX68-mjNf3AAefX8'
 $$;
 
 create or replace function public.notify_booking_created()
@@ -71,7 +87,10 @@ as $$
 begin
   perform net.http_post(
     url := public.edge_functions_base_url() || '/on-booking-created',
-    headers := jsonb_build_object('Content-Type', 'application/json'),
+    headers := jsonb_build_object(
+      'Content-Type', 'application/json',
+      'Authorization', 'Bearer ' || public.edge_functions_anon_key()
+    ),
     body := jsonb_build_object('record', to_jsonb(new))
   );
   return new;
@@ -92,7 +111,10 @@ as $$
 begin
   perform net.http_post(
     url := public.edge_functions_base_url() || '/on-inquiry-created',
-    headers := jsonb_build_object('Content-Type', 'application/json'),
+    headers := jsonb_build_object(
+      'Content-Type', 'application/json',
+      'Authorization', 'Bearer ' || public.edge_functions_anon_key()
+    ),
     body := jsonb_build_object('record', to_jsonb(new))
   );
   return new;