fix: restrict leaderboard member visibility and fix auth recursion

[mrepol742]

• Tighten public.leaderboard_members policy to only allow users to see their own membership (user_id = auth.uid()).
• Update LeaderbordList: select owner_id, capture query error, and filter joined boards to role == "member".
• Use supabase.auth.getUser() in auth proxy and return undefined at the end of the middleware.
• Log auth middleware triggers and return early in proxy.ts