Fixed Supabase webhook 401s after key rotation (verify_jwt + hardening, deployed)