feat: DB-driven whitelist with is_admin, auto-register on /start, admin commands (/adduser /removeuser /users)

supabase/migrations/01-init.sql

@@ -10,6 +10,7 @@ CREATE TABLE IF NOT EXISTS users (
     telegram_id bigint UNIQUE NOT NULL,
     username    text,
     first_name  text,
+    is_admin    boolean NOT NULL DEFAULT false,
     is_active   boolean NOT NULL DEFAULT true,
     created_at  timestamptz NOT NULL DEFAULT now()
 );

supabase/migrations/post-boot.sql

@@ -1,8 +1,12 @@
 -- ============================================================
 -- post-boot — runs after all migrations have been applied.
 -- Grants INSERT/UPDATE to authenticator on user-facing tables.
--- (Run after 01-init.sql so tables exist.)
+-- Seeds initial admin user (telegram_id 298181113).
 -- ============================================================
 
 GRANT INSERT, UPDATE ON search_queries TO authenticator;
 GRANT INSERT, UPDATE ON notifications TO authenticator;
+
+INSERT INTO users (telegram_id, username, first_name, is_admin, is_active)
+VALUES (298181113, NULL, 'Admin', true, true)
+ON CONFLICT (telegram_id) DO NOTHING;