fix(supabase): confirm the recovery session before calling setSession

[Cypher-Aura-19]

What

Adds a short Password recovery subsection to the Supabase skill's ## Debugging section so agents establish which stage of a recovery/auth-callback flow already succeeded before changing session state.

Why

A recovery flow may already have established the recovery session before the application renders.

Without guidance for that case, an agent can incorrectly add manual supabase.auth.setSession() handling even though session establishment has already happened, disrupting an otherwise successful recovery flow.

Change

The guidance now tells agents to:

• gather safe evidence first using Auth logs and current auth state without logging tokens, cookies, passwords, or session credentials;
• distinguish an already-established session from raw, unconsumed tokens;
• use existing recovery state or PASSWORD_RECOVERY when appropriate instead of automatically establishing another session;
• account for different recovery architectures such as implicit, token_hash + verifyOtp, and PKCE/code-exchange flows;
• verify the fix through an actual recovery interaction rather than relying only on build/typecheck success.

setSession() is not treated as universally wrong. The guidance only avoids calling it redundantly when the recovery session has already been established.

Verification

• vitest run — 7/7 tests pass
• git diff --check — clean
• one file changed: skills/supabase/SKILL.md

Fixes #430.