fix(deps): pin supabase CLI to 2.58.5, before the new API-key rollout

2.109.1 defaults local `supabase start` to sb_publishable_/sb_secret_
keys, and the anon-role auth path for those keys against this repo's
local Postgrest/RLS setup doesn't work (every client request hangs/
fails, which is why the e2e auth spec timed out waiting on the header).
2.58.5 is the last version confirmed working against this stack; keep
the setup-cli@v3 lockfile-based version detection and the dynamic
`supabase status -o env` key export from the rest of this PR so this
doesn't hand-drift out of sync again.

Author: claude

package.json

@@ -125,7 +125,7 @@
     "oxlint": "^1.11.1",
     "postcss": "^8.4.47",
     "prettier": "^3.6.2",
-    "supabase": "2.109.1",
+    "supabase": "2.58.5",
     "tailwindcss": "^3.4.11",
     "tsx": "^4.20.3",
     "typescript": "^5.5.3",