Electric: enforce one-way Supabase authority in managed mode

[100yenadmin]

Closes #5 only after the separate relay policy gate is also satisfied.

Stacked on #21 (feature/4-managed-electric-login) because merge authority is outside this implementation program. Retarget to main after #21 merges.

What changed

• consumes the dashboard broker's server-derived role, assignment, reconciliation status, and access revision
• enables managed relay access only when reconciliation is current (and agent_only assignment is assigned)
• remounts managed caches by server authority revision and prevents snapshots/onboarding state from restoring stale access
• derives the only managed community from the entitlement and makes native community, channel, membership, DM, huddle, and agent authority paths read-only or unavailable
• displays server-derived role, assignment, and reconciliation state
• leaves native/upstream builds on the existing native authority policy

Local proof on 0df1fb69681d4f180fdf8405aac13c55a2e46a1a

• focused managed authority/onboarding/mention tests: 52 passed
• pnpm typecheck: passed
• biome check src: passed (1,438 files)
• file-size, px-text, pubkey-truncation, and git diff --check: passed
• focused Rust test command was attempted but this Mac cannot begin crate compilation because the existing audiopus_sys build requires an unavailable cmake; exact-head GitHub CI is the canonical Rust proof

Proof boundary

This PR is the Buzz client-side one-way-authority change. Relay rejection of hand-crafted native membership/channel/DM events remains the separate control_plane policy work in #15; this PR does not claim that relay-side gate, merge, release, deployment, or runtime canary proof.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 59e2b53b-b112-447b-8147-8df108be5d2b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/5-one-way-supabase-authority

---

_{Comment @coderabbitai help to get the list of available commands.}

[100yenadmin]

This pre-reset staging PR is closed as superseded by merged upstream-first reset PR #37 and the current thin-adapter tracker #1/#36.

No code is being deleted. The branch and review history remain available. Retained behavior was replayed narrowly in #37; dropped managed brokers, blanket guards, duplicate UI, and control-signed routine collaboration must not be revived from this PR.