fix(admin): RLS 재귀 수정 + OAuth 쿠키 + 코드 정리

- RLS: profiles 재귀 참조 → app_metadata 기반으로 교체
- auth callback: 쿠키를 response에 직접 설정 (세션 유지)
- middleware: Supabase 세션 갱신 추가
- layout: requireAdmin() 사용으로 통합 (중복 제거)
- admin-guard: app_metadata.role 기반 (JWT, DB 쿼리 불필요)
- debug 라우트 제거
- config.toml: localhost:3000/3001 redirect URL 추가

server/supabase/config.toml

@@ -42,6 +42,8 @@ enabled = true
 site_url = "http://localhost:5173"
 additional_redirect_urls = [
   "http://localhost:5173",
+  "http://localhost:3000",
+  "http://localhost:3001",
   "https://d3ro.dev",
   "d3ro-voice://auth-callback"
 ]

server/supabase/migrations/20260413000003_fix_admin_rls.sql

@@ -0,0 +1,27 @@
+-- 재귀 RLS 정책 제거 + app_metadata 기반으로 교체
+-- profiles 테이블에서 자기 자신을 서브쿼리하면 무한 재귀 발생
+
+-- 1. 기존 재귀 정책 삭제
+DROP POLICY IF EXISTS "admin_read_all_profiles" ON public.profiles;
+DROP POLICY IF EXISTS "admin_read_all_subscriptions" ON public.subscriptions;
+DROP POLICY IF EXISTS "admin_read_all_daily_usage" ON public.daily_usage;
+
+-- 2. auth.users.raw_app_meta_data 기반 admin 정책 (재귀 없음)
+-- 관리자 설정: UPDATE auth.users SET raw_app_meta_data = raw_app_meta_data || '{"role":"admin"}' WHERE id = '...'
+CREATE POLICY "admin_read_all_profiles" ON public.profiles
+  FOR SELECT TO authenticated
+  USING (
+    (auth.jwt() -> 'app_metadata' ->> 'role') = 'admin'
+  );
+
+CREATE POLICY "admin_read_all_subscriptions" ON public.subscriptions
+  FOR SELECT TO authenticated
+  USING (
+    (auth.jwt() -> 'app_metadata' ->> 'role') = 'admin'
+  );
+
+CREATE POLICY "admin_read_all_daily_usage" ON public.daily_usage
+  FOR SELECT TO authenticated
+  USING (
+    (auth.jwt() -> 'app_metadata' ->> 'role') = 'admin'
+  );