Fix secure evaluator access

[eeminionn]

What changed

• replaces direct PostgREST access to the unexposed private schema with read/write RPCs restricted to service_role
• grants the backend role explicit access to application tables instead of relying on project-specific default privileges
• routes student hidden-test reads and all mentor secure-variant operations through the RPC boundary
• keeps hidden tests and reference solutions inaccessible to anon and authenticated
• surfaces the JSON error returned by an Edge Function instead of the generic non-2xx SDK message
• adds pgTAP permission coverage and frontend/security regression tests

Root cause

submit-code called .schema("private") through the Supabase Data API. The schema is intentionally not exposed, so PostgREST rejected the hidden-test query and the submission stopped before Judge0 evaluation. mission-admin used the same broken path for staff solutions and mission editing. Fresh Supabase databases also showed that service_role table access depended on historical default grants, so the migration now declares those backend privileges explicitly.

User impact

Students can submit assigned work and run hidden tests without gaining access to those tests. Mentor solution and version-editing flows use the same secure server-only boundary. Future HTTP failures expose a useful Spanish reason in the results console.

Validation

• pnpm check (16 legacy tests, TypeScript, Edge Functions, 21 v2 tests, 60 reference solutions and production build)
• pnpm test:e2e (9/9)
• pnpm typecheck:edge
• deno fmt --check for the new TypeScript files
• git diff --check

Closes #29