Use Supabase and protect automatic deployments - #3

Summary

Moves QueryMindAI production metadata storage from the suspended Render PostgreSQL resource to a backend-only Supabase connection and makes every protected main merge deploy both applications after CI passes.

Changes

• remove the Render-managed PostgreSQL resource from render.yaml
• make API DATABASE_URL a non-synced Render secret
• document the Supabase Session pooler URL and TLS requirements
• remove Render root-directory and path-filter restrictions
• run backend and frontend CI for every PR and every push to main
• deploy both Render services automatically only after CI passes
• add @gopalmani as repository CODEOWNER
• document migration and suspended-database cleanup steps

Required manual configuration

1. Rotate the Supabase database password if it has been shared outside a secret manager.
2. In Supabase Connect, copy the Session pooler URL on port 5432.
3. Use the postgresql+psycopg2:// prefix and append ?sslmode=require.
4. Set the complete URL directly as the querymind-api DATABASE_URL secret in Render.
5. Confirm the Render Blueprint is linked to main with Auto Sync enabled.
6. Merge this PR; both CI workflows run and Render deploys both services after they pass.
7. Verify API /health and /ready before deleting the suspended Render database.

No Supabase password or connection URL is committed.

Validation

• Render and GitHub Actions YAML parse successfully
• referenced root-level build and start paths exist
• no database credential appears in the repository
• live migrations require the Render DATABASE_URL secret
• Docker is unavailable in the local environment

Branch protection

main now requires an up-to-date branch, backend test, frontend verify, one approval, CODEOWNER review, and resolved conversations. Force pushes and branch deletion are disabled. Admin bypass remains available for owner-authored pull requests.