Supabase Data API grants and ops hardening

# Supabase Data API grants and ops hardening LicenseChain runs on a shared PostgreSQL database (Supabase) across Dashboard, API, Website, and Status. New tables need explicit grants so the Supabase Data API and service roles can read what applications expect. ## What changed - Applied migration 20261021000000_supabase_data_api_default_grants so new public tables receive the correct default privileges for authenticated and service roles. - Re-ran Status cron probes with CRON_SECRET so stale August 2026 lastChecked timestamps no longer mark Marketplace as degraded when live payment webhooks respond correctly. - Confirmed Website newsletter webhooks verify Resend Svix signatures (WEBSITE_RESEND_WEBHOOK_SECRET). ## Why it matters Sellers and developers depend on accurate license lookups and health pages. Default grants prevent silent Data API denials after schema changes. Fresh status probes keep https://status.licensechain.app honest about partner payment rails. ## Next steps - Keep Prisma migrations owned by Dashboard; sync sibling schemas after each change. - Prefer Bearer CRON_SECRET or Vercel Cron for /api/cron/check-status so probes stay current.