feat: auth-gate demo chat + budget circuit breaker

Gate the demo chat behind Supabase auth: the widget now fetches Supabase
config on open, shows a compact sign-in pane (Google OAuth or email/password)
when the user is unauthenticated, and passes the access_token to /api/demo.
The server verifies the token via supabase_auth_user() before any processing
and uses the verified user ID as the rate-limit key.

Add a budget kill switch: a demo_config table in Supabase holds a
demo_enabled flag that /api/demo polls every 60s (cached, fails open).
A Cloud Function (demo-budget-guard) is triggered by a GCP Pub/Sub budget
alert and sets demo_enabled = 'false' when spend crosses 90% of the $150
daily budget. Budget and topic are provisioned; function is live in
us-central1.

migrations/20260510000000_demo_config.sql

@@ -0,0 +1,22 @@
+-- 20260510000000_demo_config.sql
+--
+-- Kill switch for the demo chat endpoint. Backs the budget-alert Cloud Function
+-- that flips demo_enabled to 'false' when GCP spend crosses 90% of the daily
+-- budget threshold. The web tier polls this table with a 60s TTL cache so the
+-- demo is disabled within one minute of a budget alert firing.
+--
+-- Service-role bypasses RLS. Public anon has no access (policy USING (false)).
+
+CREATE TABLE IF NOT EXISTS public.demo_config (
+    key        text         PRIMARY KEY,
+    value      text         NOT NULL,
+    updated_at timestamptz  DEFAULT now()
+);
+
+ALTER TABLE public.demo_config ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "service only" ON public.demo_config USING (false);
+
+-- Seed the kill switch as enabled
+INSERT INTO public.demo_config (key, value) VALUES ('demo_enabled', 'true')
+    ON CONFLICT (key) DO NOTHING;