Sync from docs: Supabase Data API grants, RLS, and publishable keys (powersync-docs #453)

[bean1352]

Generated by Claude. Review carefully before merging.

Source docs PR: powersync-ja/powersync-docs#453

What changed in docs

Supabase is rolling out a new default (enforced for all new projects from May 30, 2026) where tables in the public schema are no longer automatically exposed to the Data API; explicit GRANT statements are now required. The guide also notes that new Supabase projects issue publishable keys (prefixed sb_publishable_…) in place of the legacy anon key.

Skill updates in this PR

• skills/powersync/references/supabase-auth.md — Added a Data API Grants subsection under "Supabase Database Setup" with the required SQL and an explanation of how grants and RLS interact; updated the uploadData() "Important" note to clarify that a missing grant causes 42501: permission denied for table before RLS is evaluated; added a publishable keys callout after the fetchCredentials() JS/TS example.
• skills/powersync/references/onboarding-supabase.md — Updated Phase 1 step 2 to note that new Supabase projects use publishable keys and to use them as the value for SUPABASE_ANON_KEY.

Notes for reviewer

• The Data API grants rollout timeline (April 28 opt-in / May 30 new-project default / October 30 enforced on all existing projects) is taken directly from the docs PR. The skill only calls out the May 30 date (when new projects are affected by default) to keep it simple; the October 30 enforcement date for existing projects was intentionally left out to avoid cluttering agent-facing content with a future deadline that doesn't affect new project setup today.
• The supabase-auth.md "Supabase Database Setup" section uses lists and todos as example table names (matching the existing publication SQL examples). Reviewers may want to consider whether a more generic example (e.g. your_table) would serve agents better, but that is out of scope for this sync.
• No new skill files were created; all changes are additive edits to existing files.
• AGENTS.md and SKILL.md were not modified — the routing entry for references/supabase-auth.md in AGENTS.md already covers "Supabase" broadly and does not need updating for this change.

---

Generated by Claude Code