feat(backend): supabase hackathons table, RLS read policy, and seed

[henryng15]

Closes #11.

Stands up the Supabase hackathons read replica that the globe reads from, plus the one-off seed that proves the shape works. The table itself is dashboard state; this PR carries the mapping code, the tests, and the env hygiene that goes with it.

Acceptance

• Table created with the columns from the issue
• RLS on: anon can select visible rows, anon cannot write
• SUPABASE_URL + SUPABASE_SERVICE_KEY added as repo secrets
• Verified a manual seed of current listings loads — 32 rows

Schema deviation — please read before #13

listings.json gained two fields after this issue was written, and the issue's DDL has no columns for them:

• deadline (ISO date) — from the deadline watcher, [Enhancement] Scheduled deadline watcher for existing listings #54. Present on 21 of 32 listings.
• featured (bool) — from the favorites feature, Feature: "Favorites" — flag + filter to pin the best-of-the-best hackathons #21/Add a "favorites" field to highlight curated picks #25. Present on 3.

Seeding against the literal DDL would have made PostgREST reject the payload, and the workaround would have been to silently drop both fields — which is exactly the data #17's detail card and #18's filters will want. So the table has two extra columns:

alter table public.hackathons
  add column if not exists deadline date,
  add column if not exists featured boolean default false;

deadline is date, not text, so #18 can do range queries.

@vickmahi — write #13's sync against this shape, not the DDL in the issue body. build_row() and upsert() in seed_supabase.py are importable for exactly that reason; please reuse them rather than reimplementing the company_name → host mapping.

Verification

RLS was checked against the live project with the anon key:

• select on visible rows → 200, content-range: 0-31/32
• insert → 401, 42501: new row violates row-level security policy, no row written

RLS is default-deny and public read is the only policy, so update/delete are refused for the same reason. All 32 rows have lat/lng/geo_status null, waiting on the geocoder in #12.

Notes

• The seed is idempotent: upsert on the id primary key with Prefer: resolution=merge-duplicates. Re-running does not duplicate.
• Root .gitignore did not cover .env. Only web/.gitignore did, so a key pasted anywhere else in the repo would have been tracked. Fixed here.
• site/.env.example lands early because the anon key had to go somewhere documented. Frontend: Scaffold Vite + React + TS + Tailwind app (site/) #14 owns the rest of site/.
• Soft-delete of removed listings is deliberately out of scope — that's Backend: Sync GitHub Action (listings.json → geocode → Supabase upsert) #13's fourth bullet.