Parent hand-off: admin creates parent/teacher accounts + portal edit

- Admin server function (service-role) to create accounts, set role, and
  optionally link a parent to a student; wired via env_file (.env.secret)
- Admin > Users: "Add a user" form (teacher/parent/admin) with one-time temp password
- Student profile > Family: "Parent portal access" — create + link a parent login
- Parents can now edit their own child's profile (RLS-scoped); internal notes stay admin-only

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -11,14 +11,15 @@ services:
     image: info-share-spot:latest
     container_name: info-share-spot
     restart: unless-stopped
+    # Runtime secrets (SUPABASE_SERVICE_ROLE_KEY) live here — gitignored, not in the repo.
+    env_file:
+      - path: .env.secret
+        required: false
     environment:
       # SSR runtime vars (public-safe). Compose substitutes these from the .env
       # file next to this compose file.
       SUPABASE_URL: ${SUPABASE_URL}
       SUPABASE_PUBLISHABLE_KEY: ${SUPABASE_PUBLISHABLE_KEY}
-      # Only needed if you ever use the server-side admin (service-role) client.
-      # Set it in Dockge's env editor, never commit it:
-      # SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
       HOST: 0.0.0.0
       PORT: 3000
     labels: