chore: deploy Phase 2A backend to live Supabase project (Task 9)

Substitutes the real admin UID everywhere the placeholder appeared,
points the Edge Functions base URL at the deployed project, and adds
production JWT verification: trigger functions now send the anon key
as a bearer token so verify_jwt can stay enabled instead of leaving
the functions open to unauthenticated calls from the public internet.

Also adds scripts/create-admin.ts (one-off helper used to create
Mira's admin auth user), documents the seed script's non-VITE env
vars in .env.example, and closes a gitignore gap where plain .env
wasn't excluded alongside .env.local.

Claude-Session: https://claude.ai/code/session_01NhxA4npAXAxmCDEJt6kxSH

supabase/tests/database/rls.test.sql

@@ -88,7 +88,7 @@ select throws_ok(
 
 -- The admin (matching UID) can read bookings
 set local role authenticated;
-set local request.jwt.claim.sub = '00000000-0000-0000-0000-000000000001';
+set local request.jwt.claim.sub = '21c90224-e0b2-412e-a431-8e7f097c1cef';
 select isnt_empty(
   $$ select * from public.bookings $$,
   'admin can read bookings'