fix(auth): set app_metadata.tenant_id in joinCurrentSchool action

New users joining a school via /join-school had null tenant_id in
app_metadata, so the JWT hook couldn't inject tenant claims. Client-side
exam submissions then failed RLS (get_tenant_id() returned wrong tenant).

Fix: set app_metadata.tenant_id via admin client before refreshing the
session, same pattern as create_school RPC.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

app/actions/join-school.ts

@@ -113,6 +113,11 @@ export async function joinCurrentSchool() {
       { onConflict: 'user_id,tenant_id', ignoreDuplicates: true }
     )
 
+  // Set app_metadata.tenant_id so the JWT hook includes it in claims
+  await adminClient.auth.admin.updateUserById(user.id, {
+    app_metadata: { tenant_id: tenantId },
+  })
+
   // Update user's preferred tenant
   await supabase.auth.updateUser({
     data: { preferred_tenant_id: tenantId }