Port Railway API to Supabase Edge Functions and SQL

[Muawiya-contact]

Purpose

Draft candidate for #416, the HTTP API part of the three-step Railway exit. This targets develop. Railway and production clients remain unchanged. The owner chose to retain the full API scope, so this PR stays draft until every route and acceptance check is ready.

Implemented

• Inventory all 73 OpenAPI paths and four browser HTML paths, with a method/consumer/security route matrix. Browser HTML moves in [Supabase migration 3/3] Release, cut over clients and cron, then retire Railway #418.
• Add a manually authenticated Supabase Edge Function and service-role-only SQL RPCs for health, topics, concept detail, Like/Save, notifications, push tokens, streak stats, learner history, saved pages, subtopic progress/acknowledgment, daily lesson selection and completion, achievements collection/acknowledgment, review completion, folded startup state, followed-topic replacement, profile editing, learner analytics, private profile-sharing settings, filtered public profiles, connection preferences, connection pages, connection status and requests, connection actions, token-based blocking, unblock, directed relationship status/connect/remove/block/list, weekly quiz selection/attempts, subtopic quiz selection/attempts/history, editorial identity, versioned editorial profile-name requests, reviewer notification timezones, verified-TOTP authenticator settings, and owner approval of a reviewer name. These cover 44 of 73 API paths; 29 remain.
• Add guarded GitHub staging jobs for schema inspection, the owner-authorized demo reset, fresh schema installation, incremental SQL, candidate Edge deployment, and authenticated learner smoke. The incremental runner is restricted to the reviewed staging project and checks the 0049 baseline plus explicit before/after 0050–0084 RPC signatures.
• Add the editorial capability/name/MFA gate and bounded reviewer GET page; reviewer invitation POST remains to port.
• Keep candidate migrations ordered and the reviewed schema contract current through 0084. No candidate migration is recorded as production-applied.

Verified

• Protected staging reset, migrations 0001–0049, and the initial Edge deployment succeeded. With the owner's approvals, SQL runs 38726466061, 38735682216, and 38739632606 applied and verified migrations 0050–0059; Edge runs 38726754703, 38736653739, and 38740221408 deployed matching candidate commits. The latest live staging /health returned 200 with a reachable database; anonymous /v1/topics returned 401. No production endpoint or client was changed.
• Protected SQL run 38748163954 applied and verified migrations 0060–0065 in staging. Edge run 38748701535 deployed matching commit 4cabca5. The live /health returned 200 with a reachable database; unauthenticated /v1/topics returned 401.
• Protected SQL run 38754177200 applied and verified migrations 0066–0070 in staging. Edge run 38754683827 deployed matching commit 7ffc6a7. Live /health returned 200 with a reachable database and anonymous /v1/topics returned 401.
• The full backend suite passed 666 tests against disposable PostgreSQL 16 at an earlier candidate commit. Migrations 0060–0084 and their routes passed focused PostgreSQL 16 tests, the incremental signature check, and the reviewed schema contract; Edge TypeScript, 56 Node handler tests, Ruff, and whitespace checks passed locally.
• All three hosted PR quality jobs passed on 35d08b2. Checks on the newest editorial commits are pending.

Remaining before review and merge

• Apply migrations 0071–0084 and deploy their routes after hosted checks. The reviewed SQL tag for 0071–0073 is queued behind protected authenticated smoke run 38755787072, which awaits approval. Staging has no production learner or reviewer traffic.
• Port and verify the other 29 API paths, especially reviewer and owner operations and private avatar upload/delete. Keep editorial disabled until dedicated staging owner/reviewer role and MFA checks pass.
• Prove JWT/session, role/MFA, account isolation, pagination/error, concurrent writes, timezone, offline replay, privacy, browser CORS, and 500-daily-user usage behavior end to end. Document limits and rollback.
• [Supabase migration 2/3] Move all scheduled workers to Cron and bounded Edge jobs #417 owns scheduled workers; [Supabase migration 3/3] Release, cut over clients and cron, then retire Railway #418 owns browser HTML and production client cutover. Keep this PR draft and [Supabase migration 1/3] Port the complete HTTP API to Edge Functions and SQL #416 open until the full acceptance criteria pass.

Related to #416.