Harden auth, support deletion, and CI secret handling

[Iron-Mark]

Fixes the security review of the last 10 merged PRs, including backend changes for the live Supabase project.

Backend (apply on the live linked project)

• Bind support_requests.user_email / user_id to the JWT via a before-insert trigger so clients cannot spoof another mailbox.
• Add support_requests.user_id → auth.users(id) ON DELETE CASCADE and FORCE RLS.
• request_account_deletion() now deletes support_requests, then queues the audit row, then deletes the caller through private.delete_own_auth_user() (SECURITY DEFINER, 0 args, auth.users.id = auth.uid() only).
• Canonical 20260614062844_recreate_flowfit_backend.sql stays free of security definer.
• Local Auth password policy is letters_digits with min length 8.

This environment cannot db push --linked (no Supabase MCP/session). After merge, apply with:

npx -y supabase@2.115.0 db push --linked --dry-run
npx -y supabase@2.115.0 db push --linked
pwsh -NoProfile -File scripts/verify_supabase_backend.ps1 -Linked -Output json -RequireAllPass

Live project ref from launch docs: xhmkghwijqpvnbpeeckg.

App

• Verified email deep links go to /age-gate (no email in route args).
• OpenRoute key is opt-in via FLOWFIT_OPENROUTE_API_KEY; empty key skips GPS HTTP.
• Default support contact is the source token support@flowfit.com (production inbox still comes from dart-define/env).
• Landing and age-gate copy tell a parent/guardian to create and supervise the account.
• Wear PhoneDataListenerService stays exported=true (required for BIND_LISTENER_SERVICE); comment only.

CI

• Pin first-party Actions to commit SHAs.
• Pin Supabase CLI to supabase@2.115.0.
• Do not upload supabase status JSON or start logs (JWTs / service_role / DB URL).
• GitHub Pages pages: write + id-token: write are granted only on the main-branch deploy job.