fix: Supabase RLS, storage, auth, and week cycle bugs

[SaharPak]

Summary

Fixes production bugs across Supabase (RLS, storage, week logic) and the Next.js app (auth, validation, error handling).

Database migrations (run in Supabase SQL Editor)

Migration	What it teaches / fixes
004_storage_product_images.sql	Storage RLS — bucket + upload/read policies scoped to products/{user_id}/…
005_rls_fixes.sql	Row Level Security — builders read own hidden products; votes/comments only on live products; demo archive visibility
006_current_week_cycle.sql	DB functions — current_week() matches Sat–Fri Helsinki cycle (same as app)

App fixes

• Auth: Callback no longer skips onboarding on Cloudflare; open redirects blocked; onboarding enforced until handle is set
• Week cycle: Weekend submissions roll to next week; Friday demo picker aligned with countdown
• Submit: Live demos require a Friday slot; removed silent fallback that dropped demo fields
• Cron: Returns 500 on upsert failures instead of false success
• Admin: Product status errors surfaced; demo days list refreshes after snapshot
• Security: Server uses getUser() instead of getSession(); vote errors shown to users
• Build: App builds without Supabase env vars (mock mode placeholders)

How to apply

1. Merge this PR and deploy
2. In Supabase SQL Editor, run migrations 004 → 005 → 006 in order (001–003 assumed already applied)
3. Smoke test: sign up → onboarding → submit with image → vote → hide product as admin → owner can still edit