- supabaseStore(client, { prefix }) implements CreditStore over supabase-js /
  PostgREST. Redeem, the spend compare-and-swap, account/history reads and
  revoke run in SECURITY DEFINER Postgres functions (search_path = '') called
  with rpc(); codes and ledger inserts/list use from().
- supabaseMigrationSql(prefix) and migrations/supabase.sql: tables with RLS on
  and no policies, privileges revoked from anon/authenticated, functions
  executable only by service_role. Idempotent.
- Credits onGrant(userId, grant, source) hook, called after each successful
  redeem and grant(), to mirror grants into a site's own ledger.
- Tests: the full behaviour suite on the Supabase store via a fake supabase-js
  over PGlite and over real Postgres; redeem/spend races on real Postgres;
  real supabase-js + PostgREST end to end incl. anon/authenticated lockout;
  onGrant. CI workflow runs Postgres + PostgREST in Docker.
- README: "On Supabase" and "Your own ledger".

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>