docs: rewrite new-dev setup guide (env, seed, tests, gotchas)

[guillermoscript]

What

Rewrites docs/GETTING_STARTED.md as the canonical "how to run this project" guide for new devs, and fixes the README quick start.

Why

The existing instructions had three things that actively break a first run:

• README said open localhost:3000. Tenant resolution reads the subdomain, so on localhost no tenant resolves and every authenticated page bounces to /join-school. Both docs now say lvh.me:3000 and explain why.
• Guide recommended cloud Supabase first and supabase db push for local setup. Local flow is supabase start + npm run db:reset.
• Guide said to confirm the signup email via Mailpit. Email confirmations are disabled locally (config.toml → enable_confirmations = false), so signup logs straight in.

What's new

• Copy-paste .env.local block, with the keys sourced from supabase status (not hardcoded — GitHub push protection flags the local sb_secret_… literal).
• Seed-account table annotated with which subdomain to log in on — this wasn't documented anywhere and is the most common first-day dead end.
• Full seed inventory pulled from the actual DB: the two tenants (free vs enterprise, and why the seed does that on purpose), 4 courses, 4 products, 2 subscription plans, alice's pre-seeded subscription. Plus why the seed hand-writes auth.users/identities/profiles: handle_new_user() doesn't fire on direct SQL inserts.
• Migration workflow (reset-from-scratch before push, commit regenerated types alongside).
• Test instructions: unit vs E2E, and the three rules that cost people an afternoon — dev server must be up first (no webServer in the Playwright config), lvh.me not localhost, workers: 1 locally or GoTrue rate-limits the sign-ins.
• Optional services: Stripe CLI's two distinct webhook secrets, CRON_SECRET for /api/cron/*, and mcp-server defaulting to port 3000 where it fights next dev.
• Troubleshooting for the real traps: /join-school bounce, port clash + the site_url = localhost:3005 committed in config.toml, stale JWT after a role change, and the tables with no tenant_id where adding the filter errors the whole query.

Test plan

Docs only — no code paths touched.

• Every internal doc link resolves (CLAUDE.md, DATABASE_SCHEMA, AUTH, MONETIZATION, DEVELOPMENT_WORKFLOW, MIGRATIONS, I18N_GUIDE, MCP_SETUP, TROUBLESHOOTING, PROJECT_OVERVIEW).
• Seed tables verified against the running local DB (tenants, courses, products, plans, tenant_users), not against the seed file's comments.
• Ports, service URLs and auth config verified against supabase status and supabase/config.toml.
• npm script table verified against package.json.

🤖 Generated with Claude Code

https://claude.ai/code/session_01853LDokPbhv9Kg9Ctz9DB5