Add rbac-todo plugin with Supabase RLS and mcp-lite

[walkerhughes]

Adds a shared to-do list that persists in Supabase Postgres. Admins can add, update and delete to-dos; members can read them. Postgres RLS enforces this through both MCP and direct REST requests.

• Packages rbac-todo as a plugin with Claude and Codex manifests, a marketplace entry and token-based MCP configuration.
• Serves four tools from a Supabase Edge Function using mcp-lite, with a user-scoped database client on every request.
• Keeps role assignments outside the MCP so users cannot promote themselves. Demotion takes effect with the existing token.
• Includes setup instructions, a login helper, CI checks and a live integration test that cleans up its temporary users and rows.

Deployed to supabase-demo (tteazpolsuwfxqqqksoj):
https://tteazpolsuwfxqqqksoj.supabase.co/functions/v1/rbac-todo/mcp

Validation passed: Deno formatting, lint and type checks; Python lint, formatting and login-helper test; plugin validation; and live MCP/REST tests for CRUD persistence, member write denial, unauthorized access, self-promotion, input validation and immediate role demotion.

The demo uses Supabase Auth bearer tokens. Users must be assigned a role and refresh expired tokens; OAuth discovery is not implemented. The live CI job runs manually and requires the Supabase access-token secret.