feat(crud): migrate user, admin, and search APIs to Supabase

[cH0NKIIs34L]

Summary

Replace all Express-backed CRUD API modules with direct Supabase
queries so the client no longer depends on the server for data access.

What Changed

• user.api.js — replaced fetch with supabase.from('users') queries;
  getProfile reads session uid, getById queries by UUID
• admin.api.js — replaced fetch with supabase.from('users') queries
  for getAllUsers, promoteUser, and demoteUser
• search.api.js — replaced fetch with a dynamic Supabase query chain
  supporting ilike, eq, gte, lte, and whitelisted order
• ProfilePage.jsx — updated to consume { data, error } shape; column
  refs updated to snake_case (created_at, last_login)
• UserManagementPage.jsx — updated to consume { data, error } shape
• UserRow.jsx — updated to consume { error } from adminApi; date
  field updated to created_at (snake_case)
• SearchPage.jsx — updated to consume { data, error } shape
• All three api test files rewritten to mock the Supabase client chain

---

What

This PR replaces userApi, adminApi, and searchApi with Supabase
CRUD equivalents and updates all consuming components accordingly.

Why

The Express server routes for user, admin, and search will be deleted
in Epic 4. Migrating the API modules now ensures the client is fully
decoupled from the server before the cleanup happens.

How

• All three api modules now import from client/src/lib/supabase.js
  and build query chains directly — no fetch, no BASE_URL
• userApi.getProfile() reads the active session uid via
  supabase.auth.getSession() before querying, rather than relying
  on a server session cookie
• adminApi promote/demote use .update().eq().select().single() so
  the updated row is returned in the same shape as before
• searchApi builds the query chain conditionally — each filter is
  only appended when a value is present, preserving the existing
  URL-state behaviour in SearchPage unchanged
• Sort column is whitelisted against a fixed array before being passed
  to .order() — same injection protection as the old Prisma layer
• Snake_case column names (created_at, last_login) replace the
  old camelCase Prisma aliases throughout consuming components
• All api test files mock the Supabase client chain with a shared
  _chain ref pattern to avoid re-creating the mock per method

Testing

• All new test files cover: default query shape, each filter applied
  in isolation, sort fallback for invalid values, and error shape
• Consuming component tests (ProfilePage, UserManagementPage,
  SearchPage) will need mock updates in Epic 5 (Issue #15)

---

Pre-Merge Checklist

• Synced with main before opening this PR
• All tests pass locally (npm test in both client/ and server/)
• No console.log left in production code
• Self-reviewed my own diff before requesting review
• Added or updated tests for the changes made
• No new ESLint errors (npm run lint)