refactor(server): strip Express to Supabase-ready shell

[cH0NKIIs34L]

Summary

Remove all Express auth, CRUD, and database layers now superseded by
Supabase, leaving the server as a minimal shell with a health endpoint.

What Changed

• app.js — removed Passport init, EJS view engine, static assets
• index.routes.js — replaced all route mounts with GET /api/health
• app.middleware.js — removed Passport, cookie-parser, static, EJS
• error.middleware.js — removed clearAuthCookie dependency (auth is Supabase now)
• server/package.json — removed all Prisma scripts and dead dependencies
• .github/workflows/ci.yml — removed PostgreSQL service container, DATABASE_URL, and Prisma steps
• Deleted: all route files, all controllers, all validators, Passport config, cookie utilities, all db/queries files, pool.js, prisma.js, all related integration and unit tests

---

What

This PR reduces the Express server to a minimal shell — CORS, body
parsing, error handling, and a single health check endpoint — with all
auth and CRUD concerns now owned by Supabase on the client side.

Why

The server previously owned auth (Passport/JWT), all database access
(Prisma/pg), and cookie management. With those concerns migrated to
Supabase in Epics 2 and 3, the remaining server code is dead weight
that would break on startup due to missing environment variables and
uninstalled packages.

How

• All deleted files are pure dead code after the Supabase migration —
  nothing in the client imports from server routes or controllers
• error.middleware.js no longer calls clearAuthCookie since there
  is no cookie-based auth session to clear
• app.middleware.js retains only CORS and body parsing — the minimum
  needed for a JSON API server
• The CI pipeline test-server job no longer provisions a PostgreSQL
  service container or sets DATABASE_URL / JWT_SECRET, since the
  server has no database connection
• server/package.json retains only express, cors, dotenv,
  @supabase/supabase-js, and the dev toolchain — all Prisma, Passport,
  bcrypt, JWT, pg, and express-validator packages removed
• The two remaining test files (app.middleware.test.js and
  error.middleware.test.js) are updated to remove mocks for deleted
  dependencies so they pass cleanly

Testing

• Verified GET /api/health returns { status: "ok" } with a 200
• Verified npm test passes in server/ with only middleware tests remaining
• Verified npm install runs clean after package.json cleanup

---

Pre-Merge Checklist

• Synced with main before opening this PR
• All tests pass locally (npm test in both client/ and server/)
• No console.log left in production code
• Self-reviewed my own diff before requesting review
• Added or updated tests for the changes made
• No new ESLint errors (npm run lint)