test(supabase): add pgTAP coverage for the money-core and secondary features

Audits the SQL schema feature-by-feature and adds pgTAP tests for the
areas that previously had zero coverage — chiefly the revenue/invoicing
"money-core" the README claims is verified but that no test exercised.

New database tests (73 assertions, all green against a live Postgres):

- 080 revenue recognition — recognize_project_revenue across recurring /
  time_based / manual / self_billing (markup), approved+billable input
  filter, manager authorization, idempotent auto upsert, retire-on-zero
  and in-window filtering.
- 090 settlement pool — settle_project_month: the README worked example
  end to end, the paid-revenue funding gate, FIFO by submission_seq with
  a partial payment, per-freelancer carry-forward across months,
  fixed-cost deduction, referral first-claim, and authorization.
- 100 invoice integrity + referrals — server-side earned/tjm/hpd recompute,
  tenant integrity, settled-status transitions, cancel-frees-entries,
  the invoiced-entry freeze, and the <=100% referral guard.
- 110 project costs — kind-discriminated CHECK constraints,
  project_cost_cumulative recurring math, mark_project_costs_paid auth and
  the reimbursable-not-payable guard.
- 120 workflow / blog / notifications — sequential invoice numbering,
  time-entry approver stamping + submit/review notifications, the
  correction net-non-negative guard, and blog published-only RLS.

Every audited behavior matched the intended design; no schema defects were
found. The tests lock that behavior in.

Also adds a Docker-free local runner (tests/_run_local.sh +
_local_bootstrap.psql) that rebuilds a throwaway DB from a minimal Supabase
stand-in + the migrations and runs the suite with pg_prove. Both files are
underscore-prefixed and non-.test.sql, so the Supabase test runner skips them.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W2RkSqhagEjBj8ncHGBGRo

Author: claude

backend/supabase/README.md

@@ -37,3 +37,32 @@ pnpm types          # regenerate ../../packages/sdk/src/schema.ts
 pnpm push           # db push to the linked project
 pnpm test           # pgTAP database tests (invites + rem compute/security)
 ```
+
+## Database tests (pgTAP)
+
+`supabase/tests/database/*.test.sql` — run with `pnpm test` (needs the Supabase
+CLI + Docker). Coverage:
+
+| File | Feature area |
+|---|---|
+| `000` | shared harness + helpers |
+| `010`–`040` | company invites — accept lifecycle, escalation guards, RLS, seat/edge |
+| `050`–`070` | unified remuneration ("rem") — compute golden math, security/capacity, jungle FIFO + staffing fee |
+| `080` | revenue recognition — `recognize_project_revenue` (recurring / time_based / manual / self_billing markup, auth, retire-on-zero, in-window) |
+| `090` | settlement — `settle_project_month` funding pool: README worked example, paid-revenue gate, FIFO by `submission_seq`, per-freelancer carry-forward, fixed-cost deduction, referral first-claim, auth |
+| `100` | invoice integrity + referrals — server recompute, tenant integrity, settled-status transitions, cancel-frees-entries, invoiced-entry freeze, `enforce_referral_total` ≤100% |
+| `110` | project costs — kind-discriminated CHECKs, `project_cost_cumulative`, `mark_project_costs_paid` auth + reimbursable guard |
+| `120` | workflow/blog/notifications — sequential invoice numbering, time-entry approver stamping + submit/review notifications, correction net-non-negative guard, blog published-only RLS |
+
+### Running the tests without Docker
+
+`tests/_run_local.sh` rebuilds a throwaway DB from `tests/_local_bootstrap.psql`
+(a minimal local stand-in for the Supabase platform: roles, `auth`/`storage`
+schemas, `auth.uid()`) + every migration, then runs the suite with `pg_prove`.
+Needs a running PostgreSQL and `postgresql-<v>-pgtap`. Neither `_`-prefixed file
+is a test (they are skipped by the `*.test.sql` runner):
+
+```bash
+# against a local PG on port 54399, as the postgres superuser
+PGPORT=54399 bash tests/_run_local.sh
+```

backend/supabase/tests/_local_bootstrap.psql

@@ -0,0 +1,149 @@
+-- Local-only Supabase scaffolding so the migrations + pgTAP suite can run against
+-- a plain PostgreSQL cluster (no supabase CLI / Docker). NOT a migration — this
+-- file is never shipped or applied to the hosted DB; it recreates just enough of
+-- the platform (roles, auth + storage schemas, auth.uid()) for the tests.
+
+-- ── Roles ────────────────────────────────────────────────────────────────────
+do $$
+begin
+  if not exists (select from pg_roles where rolname = 'anon') then create role anon nologin noinherit; end if;
+  if not exists (select from pg_roles where rolname = 'authenticated') then create role authenticated nologin noinherit; end if;
+  if not exists (select from pg_roles where rolname = 'service_role') then create role service_role nologin noinherit bypassrls; end if;
+  if not exists (select from pg_roles where rolname = 'authenticator') then create role authenticator noinherit login; end if;
+  if not exists (select from pg_roles where rolname = 'supabase_auth_admin') then create role supabase_auth_admin noinherit; end if;
+  if not exists (select from pg_roles where rolname = 'supabase_storage_admin') then create role supabase_storage_admin noinherit; end if;
+end $$;
+
+grant anon, authenticated, service_role to authenticator;
+grant anon, authenticated, service_role to postgres;
+
+-- ── Schemas ──────────────────────────────────────────────────────────────────
+create schema if not exists extensions;
+create schema if not exists auth authorization supabase_auth_admin;
+create schema if not exists storage authorization supabase_storage_admin;
+
+grant usage on schema extensions to anon, authenticated, service_role;
+grant usage on schema auth to anon, authenticated, service_role, postgres;
+grant usage on schema storage to anon, authenticated, service_role, postgres;
+
+-- ── Extensions ───────────────────────────────────────────────────────────────
+create extension if not exists pgcrypto with schema extensions;
+create extension if not exists "uuid-ossp" with schema extensions;
+grant execute on all functions in schema extensions to anon, authenticated, service_role, postgres;
+
+-- ── auth.users / auth.identities (minimal shape used by tests + FKs) ──────────
+create table if not exists auth.users (
+  instance_id uuid,
+  id uuid primary key,
+  aud varchar(255),
+  role varchar(255),
+  email varchar(255),
+  encrypted_password varchar(255),
+  email_confirmed_at timestamptz,
+  invited_at timestamptz,
+  raw_app_meta_data jsonb,
+  raw_user_meta_data jsonb,
+  is_super_admin boolean,
+  created_at timestamptz,
+  updated_at timestamptz,
+  phone text default null,
+  deleted_at timestamptz
+);
+
+create table if not exists auth.identities (
+  id uuid primary key default gen_random_uuid(),
+  provider_id text,
+  user_id uuid not null references auth.users (id) on delete cascade,
+  identity_data jsonb not null,
+  provider text not null,
+  last_sign_in_at timestamptz,
+  created_at timestamptz,
+  updated_at timestamptz
+);
+
+grant all on auth.users to postgres, supabase_auth_admin;
+grant all on auth.identities to postgres, supabase_auth_admin;
+
+-- ── auth.uid() / auth.role() / auth.jwt() ─────────────────────────────────────
+create or replace function auth.uid() returns uuid
+  language sql stable
+as $$
+  select coalesce(
+    nullif(current_setting('request.jwt.claim.sub', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')
+  )::uuid
+$$;
+
+create or replace function auth.role() returns text
+  language sql stable
+as $$
+  select coalesce(
+    nullif(current_setting('request.jwt.claim.role', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role')
+  )::text
+$$;
+
+create or replace function auth.jwt() returns jsonb
+  language sql stable
+as $$
+  select coalesce(nullif(current_setting('request.jwt.claims', true), '')::jsonb, '{}'::jsonb)
+$$;
+
+grant execute on function auth.uid(), auth.role(), auth.jwt() to anon, authenticated, service_role, postgres;
+
+-- ── storage.buckets / storage.objects + helpers ───────────────────────────────
+create table if not exists storage.buckets (
+  id text primary key,
+  name text not null,
+  owner uuid,
+  public boolean default false,
+  avif_autodetection boolean default false,
+  file_size_limit bigint,
+  allowed_mime_types text[],
+  created_at timestamptz default now(),
+  updated_at timestamptz default now()
+);
+
+create table if not exists storage.objects (
+  id uuid primary key default gen_random_uuid(),
+  bucket_id text references storage.buckets (id),
+  name text,
+  owner uuid,
+  metadata jsonb,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  last_accessed_at timestamptz default now(),
+  path_tokens text[]
+);
+alter table storage.objects enable row level security;
+
+create or replace function storage.foldername(name text) returns text[]
+  language plpgsql stable
+as $$
+declare _parts text[];
+begin
+  select string_to_array(name, '/') into _parts;
+  return _parts[1 : array_length(_parts, 1) - 1];
+end
+$$;
+
+create or replace function storage.filename(name text) returns text
+  language plpgsql stable
+as $$
+declare _parts text[];
+begin
+  select string_to_array(name, '/') into _parts;
+  return _parts[array_length(_parts, 1)];
+end
+$$;
+
+grant all on storage.buckets, storage.objects to postgres, supabase_storage_admin, service_role;
+grant select on storage.buckets, storage.objects to anon, authenticated;
+grant insert, update, delete on storage.objects to authenticated;
+grant execute on function storage.foldername(text), storage.filename(text) to anon, authenticated, service_role, postgres;
+
+-- Default privileges so objects created by later migrations are reachable by the
+-- API roles the way Supabase configures them.
+alter default privileges in schema public grant all on tables to anon, authenticated, service_role;
+alter default privileges in schema public grant all on functions to anon, authenticated, service_role;
+alter default privileges in schema public grant all on sequences to anon, authenticated, service_role;

backend/supabase/tests/_run_local.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Local pgTAP runner: rebuild a throwaway DB from bootstrap + migrations (+seed),
+# then run the pgTAP suite with pg_prove. Requires a running PG on $PGPORT.
+set -euo pipefail
+
+PGPORT="${PGPORT:-54399}"
+PGHOST="${PGHOST:-127.0.0.1}"
+DBNAME="${DBNAME:-chrono_test}"
+export PGPASSWORD=""
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SUPA="$(cd "$HERE/.." && pwd)"
+PSQL="psql -v ON_ERROR_STOP=1 -h $PGHOST -p $PGPORT -U postgres -q"
+
+SEED="${SEED:-0}"
+
+echo "== drop/create $DBNAME =="
+psql -h "$PGHOST" -p "$PGPORT" -U postgres -q -c "drop database if exists $DBNAME;" -c "create database $DBNAME;"
+# pgTAP + Chrono's extensions live in the extensions schema (as on Supabase); put it
+# on the search_path so unqualified plan()/ok()/gen_random_uuid() resolve.
+psql -h "$PGHOST" -p "$PGPORT" -U postgres -q -c "alter database $DBNAME set search_path = public, extensions;"
+
+echo "== bootstrap =="
+$PSQL -d "$DBNAME" -f "$HERE/_local_bootstrap.psql" >/dev/null
+
+echo "== migrations =="
+for f in $(ls "$SUPA"/migrations/*.sql | sort); do
+  $PSQL -d "$DBNAME" -f "$f" >/dev/null
+done
+
+if [ "$SEED" = "1" ]; then
+  echo "== seed =="
+  $PSQL -d "$DBNAME" -f "$SUPA/seed.sql" >/dev/null
+fi
+
+echo "== pgTAP tests =="
+pg_prove -h "$PGHOST" -p "$PGPORT" -U postgres -d "$DBNAME" --ext .sql "$@" "$HERE"/database/*.test.sql