fix(#574): stop handing the RLS-bypassing service-role key to both required checks

[TortoiseWolfe]

Closes #574.

ci.yml and accessibility.yml — the two workflows that run on every PR,
and the only two that can block a merge — were each handed
SUPABASE_SERVICE_ROLE_KEY and TEST_USER_PRIMARY_PASSWORD. Neither can use
them.

• tests/setup.ts:236-245 mocks @/lib/supabase/{client,server} globally
• vitest.config.ts excludes every test that would need a real backend, with
  reasons that say so outright — "requires service role key", "requires live
  Supabase with admin RPC functions"

So the credential sat in the environment of the highest-frequency workflow in
the repo, for its entire history, with nothing able to reach it.

Why this one matters

The service-role key bypasses RLS entirely. It is the credential that #281,
#265 and the whole conformance suite exist to make unnecessary. Every PR run
materialised it in a runner environment where any package in the install graph
could read it from process.env.

Fork PRs were never the exposure — GitHub withholds secrets from those — which
means fork isolation was the only thing limiting it.

Verified by deletion, not by reading the config

"Nothing uses it" is exactly the kind of claim that turns out to be wrong in one
forgotten file, so I ran it both ways with the variables unset:

vitest, both unset          ->  395 files, 4282 tests, 0 failures
production build, both unset ->  succeeds; 121 <script src="*.css"> stripped,
                                 service worker stamped

validateSupabaseConfig() only warns on a missing service-role key
(src/config/payment.ts:59-63) and is guarded by typeof window === 'undefined',
so the build never depended on it either.

Scope

TEST_USER_PRIMARY_EMAIL goes too — a public var rather than a secret, but a
test-user email with no password is orphaned config.

conformance.yml, signup-mailer.yml and e2e.yml keep the key. They drive
real backends and genuinely need it. This is deliberately not a sweep.

After merge

Rotate SUPABASE_SERVICE_ROLE_KEY and TEST_USER_PRIMARY_PASSWORD. They
have been present in these jobs since the workflows were written; removing the
reference does not un-expose what already ran.

Expected CI

This touches .github/**, which is deliberately not in paths-ignore, so it
triggers E2E — and E2E will be red because Supabase is returning HTTP 402
(#567), not because of this diff. The two required checks are the real signal
here: if either goes red, that means something in them was reaching a live
backend from a job that claims to be fully mocked, which would be a more
interesting finding than this one.

🤖 Generated with Claude Code