feat(realtime): Fase 2b.0 infra + first R-series tests green

Enable postgres_changes broadcasts on shopping_items / shopping_lists and prove
the path end-to-end with Vitest Realtime tests and a pgTAP configuration check.

Infra changes that were silently blocking events
- Migration 007: shopping_items + shopping_lists added to supabase_realtime
  publication with REPLICA IDENTITY FULL (UPDATE/DELETE payloads need the full
  row so list_id-based filters work and RLS can evaluate DELETE against OLD)
- Realtime service: DB_USER=supabase_admin (superuser; supabase_replication_admin
  lacks CREATE on the `realtime` schema that the service auto-creates per tenant)
- Realtime service: SELF_HOST_TENANT_NAME=realtime so the seed tenant name
  matches the default supabase-js resolves for localhost URLs (was realtime-dev
  → TenantNotFound)

Tests
- pgTAP 004_realtime_publication.sql — P-01..P-04: publication membership and
  REPLICA IDENTITY FULL for both shopping tables
- Vitest realtime-postgres-changes.test.ts — R-01 INSERT broadcast,
  R-02 UPDATE carries full row, R-03 list_id filter isolates events
- test-utils realtime-helpers.ts — subscribePostgresChanges() returns a
  waitFor(predicate, timeout) helper that captures the SUBSCRIBED handshake
  before returning so mutations issued right after are not lost
- createClientAs now calls realtime.setAuth(token) so the server evaluates
  RLS against the test user's JWT
- Justfile test-db now globs supabase/tests/*.sql so new pgTAP files are picked
  up automatically

Totals: 54→57 Vitest, 12→16 pgTAP, 15 Playwright = 88 tests green.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Justfile

@@ -105,9 +105,12 @@ test-all: test-db test-integration test-e2e
 # `set dotenv-load` at the top of this file sources .env so POSTGRES_PASSWORD
 # is available — we forward it to psql via PGPASSWORD.
 test-db:
-    PGPASSWORD="$POSTGRES_PASSWORD" psql -U postgres -h localhost -d postgres -v ON_ERROR_STOP=1 -f supabase/tests/001_accept_invitation.sql
-    PGPASSWORD="$POSTGRES_PASSWORD" psql -U postgres -h localhost -d postgres -v ON_ERROR_STOP=1 -f supabase/tests/002_item_frequency_trigger.sql
-    PGPASSWORD="$POSTGRES_PASSWORD" psql -U postgres -h localhost -d postgres -v ON_ERROR_STOP=1 -f supabase/tests/003_promote_on_admin_leave.sql
+    #!/usr/bin/env bash
+    set -euo pipefail
+    for f in supabase/tests/*.sql; do
+        PGPASSWORD="$POSTGRES_PASSWORD" psql -U postgres -h localhost -d postgres \
+            -v ON_ERROR_STOP=1 -f "$f"
+    done
 
 # Run Vitest integration tests (RLS + trigger assertions via supabase-js)
 test-integration: