account: server-side plan lookup via /api/my-plan, scrub internal comments from JS

The /account "Loading..." spinner stayed on forever because the
browser-side waitlist read went through the anon key and didn't reach
the row. Replaced it with a POST /api/my-plan: the server verifies
the user's access_token via Supabase /auth/v1/user, then reads the
waitlist row with the service key. Bypasses RLS without exposing the
service key to the browser.

Stripped implementation comments from the served JS so the browser
doesn't broadcast how internals are shaped.

Build pipeline: declared the supabase_auth_user stub for both
build-local.sh and Dockerfile.stage so the bootstrap-injected forward
declarations match what's actually linked.

src/account.el

@@ -1189,28 +1189,20 @@ fn account_page(supabase_url: String, supabase_anon_key: String) -> String {
 
   async function loadWaitlistData(email) {
     try {
-      var result = await sb
-        .from('waitlist')
-        .select('plan, member_number, source, created_at')
-        .eq('email', email)
-        .order('created_at', { ascending: false })
-        .limit(1);
+      var sess = await sb.auth.getSession();
+      var token = sess.data && sess.data.session ? sess.data.session.access_token : '';
+      if (!token) { showNoPlan(); return; }
 
-      if (result.error) {
-        console.error('Waitlist query error:', result.error.message);
-        showNoPlan();
-        return;
-      }
+      var r = await fetch('/api/my-plan', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ access_token: token })
+      });
+      var row = await r.json();
 
-      var row = result.data && result.data.length > 0 ? result.data[0] : null;
-      if (!row) {
-        // No plan — redirect to pricing so they can choose
-        showNoPlan();
-        return;
-      }
+      if (!row || !row.plan) { showNoPlan(); return; }
       renderPlanCard(row);
     } catch (e) {
-      console.error('Failed to load waitlist data:', e);
       showNoPlan();
     }
   }