Tighten Supabase RLS for admin-only product writes

[davy-patty]

Description

Product create/update/delete is currently allowed for any authenticated user. Restrict writes to admin emails (matching NEXT_PUBLIC_ADMIN_EMAILS) while keeping public read access.

Acceptance Criteria

• Update supabase/schema.sql RLS policies so only admins can insert/update/delete products
• Public (anon) users can still select products
• Authenticated non-admins cannot mutate products or upload to the products bucket
• Document how to mark an admin in Supabase (JWT claim or profiles table)
• Admin UI continues to work for whitelisted emails

Technical Notes

• See supabase/schema.sql and lib/products.js
• Admin check today lives in lib/AuthContext.js via NEXT_PUBLIC_ADMIN_EMAILS
• Prefer a server-side/RLS source of truth over client-only checks

Labels

enhancement, help wanted

[Ranjeet2063]

I have resolved this issue in PR #345 (#345). Supabase RLS policies have been tightened with a server-side security definer function and table so only authorized admins can mutate products or upload to storage, while public read access remains enabled.