Lock down anon reads and expose api.formulacode.org for public access

[atharvas]

Summary

• Migration 00015 revokes Supabase's default GRANT SELECT ON ALL TABLES IN SCHEMA public TO anon and re-grants SELECT only on the four intentionally-public tables (repositories, pull_requests, candidate_containers, harbor_runs). Also sets the default privilege so future tables are anon-invisible. Without this, anon could read every table — RLS was only enabled on the four.
• api.formulacode.org hostname — second ingress on the datasmith-db tunnel, no Cloudflare Access application attached. Anon-key clients now have a reachable endpoint; the gated db.formulacode.org path is unchanged. Cloudflare config lives on the host, not the repo.
• Docs (remote-access.md, CLAUDE.md) updated to describe the two-hostname split and call out migration 00015 as required alongside 00012.

Verification

Confirmed live against api.formulacode.org after applying 00015:

• repositories, pull_requests, candidate_containers, harbor_runs — 200 with rows
• packages, candidate_prs, error_logs, runner_progress, runner_failures, hook_cache — 401 permission denied
• POST to repositories — 401 new row violates row-level security policy
• db.formulacode.org still 403 from CF Access without service token
• Service-role path (postgres user on host) unaffected

Test plan

• make check clean (ruff, mypy, deptry)
• uv run pytest — 598 passed
• Confirm GitHub Actions green
• Apply 00015 against any other Supabase instances that already have 00012