ci(deploy): establish staged Dokploy promotion

apps/mobile/eas.json

@@ -11,12 +11,16 @@
     },
     "preview": {
       "node": "20.10.0",
-      "distribution": "internal"
+      "distribution": "internal",
+      "env": {
+        "EXPO_PUBLIC_API_URL": "https://api.preprod.sauci.app"
+      }
     },
     "production": {
       "node": "20.10.0",
       "autoIncrement": true,
       "env": {
+        "EXPO_PUBLIC_API_URL": "https://api.sauci.app",
         "EXPO_PUBLIC_SUPABASE_URL": "https://ckjcrkjpmhqhiucifukx.supabase.co",
         "EXPO_PUBLIC_SUPABASE_ANON_KEY": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNramNya2pwbWhxaGl1Y2lmdWt4Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjcxMDc1ODEsImV4cCI6MjA4MjY4MzU4MX0.7FA_RmFXUjlmZF96O9xlAUfxHrQrSIZcJclNReLL4lI",
         "EXPO_PUBLIC_REVENUECAT_IOS_API_KEY": "appl_lfPyYonFQtVytftPAfXIrGsMNFu",

apps/supabase/AGENTS.md

@@ -1,16 +1,16 @@
-# Supabase backend
+# Legacy Supabase data plane
 
-This directory owns local configuration, migrations, Edge Functions, seeds, and
-integration tests.
+This directory preserves the former product-data schema, Edge Functions, seeds,
+and migration source needed for audited cutover. Hosted Supabase now owns Auth
+only. The active application schema and server code live under `apps/api`.
 
 ## Schema safety
 
-- Create migrations only with `npm run db:migration:new -- <name>`.
-- Edit only `apps/supabase/migrations/`; this is the authoritative migration tree.
+- Do not add product-data migrations or functions here.
+- Do not deploy this migration tree or these Edge Functions to hosted Supabase.
 - Never use any remote `apply_migration` tool.
-- Never execute DDL through MCP SQL tools; those tools are `SELECT`-only.
+- Never execute DDL through MCP or provider SQL tools.
 - Never link or reset a remote project during local verification.
-- Cron/function URLs must resolve per environment, never hardcode production.
 
 ## Function boundaries
 
@@ -21,5 +21,5 @@ integration tests.
 - Preserve CORS handling and return non-sensitive errors.
 - Test RLS, authorization, and important side effects, not only HTTP status.
 
-Verify with local reset, `npm run test:supabase`, invariant lint, and affected
-client tests. See `docs/operations/database-migrations.md`.
+Legacy tests may be run during cutover archaeology, but they are not the active
+deployment gate. See `docs/operations/database-migrations.md`.