[SAL-DB-01] Pin db-v1 contract and generated Supabase types in sal-site

[diese-tech]

Dependency

Blocked by #156 and #172 until diese-tech/sal-database publishes verified db-v1.0.0.

Required outcome

• Vendor the released generated/database.types.ts under the site source tree.
• Commit db-contract.lock.json with repository, release, full commit, migration head, and types SHA-256.
• Add sync-db-contract and CI drift verification against the exact remote commit.
• Type every Supabase client as SupabaseClient<Database>.
• Replace manual row casts with generated helpers and runtime validation for JSON payloads.
• Remove active site migration ownership only after both consumers pin v1.

Acceptance

Vendored bytes and hashes match the immutable release and a deliberate drift fails CI. No Git submodule or floating branch is used.

Audit ID: SAL-DB-01.

[diese-tech]

Progress update: PR #203 now pins and vendors immutable db-v1.3.0 and CI verifies the exact contract at c76c1781b95bcc118c6d94f503ba62197c6e1f6a. Keeping this issue open because the legacy supabase/migrations evidence still lives under the conventional active path and several stats readers retain manual row casts; those remaining acceptance items should be handled in an isolated cleanup PR.