feat: phase 1 of runtime config store (neuron_config table, chat.model)

New Supabase table neuron_config keyed on (key, scope) with jsonb
value column. Web tier reads chat.model via /api/demo with 60s TTL
caching, passes to soul via dharma envelope payload.model. No more
revision-rollout-per-model-swap.

Admin read endpoint at /api/admin/config gated by NEURON_ADMIN_TOKEN.
Write surface and Realtime subscription land in Phase 2.

Backlog: bl-6eb51893

migrations/20260502171044_neuron_config.sql

@@ -0,0 +1,29 @@
+-- 20260502171044_neuron_config.sql
+--
+-- Phase 1 of the runtime config store. Backs bl-6eb51893.
+--
+-- Adds public.neuron_config: a (key, scope) -> jsonb runtime config table.
+-- The web tier reads it at request time with a 60s TTL cache and passes
+-- chat.model down to soul via the dharma envelope payload, so swapping
+-- models becomes a row update (not a Cloud Run revision rollout).
+--
+-- Phase 2 will add Realtime subscription + write surface + admin UI.
+
+create table if not exists public.neuron_config (
+    key        text         primary key,
+    value      jsonb        not null,
+    scope      text         not null default 'prod',
+    updated_at timestamptz  not null default now(),
+    updated_by text
+);
+
+alter table public.neuron_config enable row level security;
+
+-- No policies. Service-role bypasses RLS. Public anon has no access. The
+-- table is server-side only; the web tier reads it with the service key.
+
+insert into public.neuron_config (key, value, scope, updated_by) values
+    ('chat.model',  '"claude-sonnet-4-5"'::jsonb,                       'prod', 'system'),
+    ('chat.format', '"anthropic"'::jsonb,                               'prod', 'system'),
+    ('chat.url',    '"https://api.anthropic.com/v1/messages"'::jsonb,   'prod', 'system')
+on conflict (key) do nothing;