PostgREST with the service key (PATCH, bypasses RLS)

The project-scoped PostgREST forwarder for server-side code holding the project service key (role service_role, bypasses row-level security): the route behind in-function adminDb().from(). The path's project must be the key's (403 PROJECT_MISMATCH otherwise). /rest/v1/* refuses the service key; end users and browsers use /rest/v1/* with the anon key. Replaces /admin/v1/rest/*, which is retiring. A SIWX wallet (SIGN-IN-WITH-X), a sign-in session bearer, or a grant key bearer is also accepted, authorized by the caller's own authority on the project (no service key): project.database.read (org role viewer or higher, or a grant / grant key carrying database:read) and project.database.write (developer or higher, or database:write, which also reads). The credential's shape picks the path; a principal call never returns a key and is audited (with a SHA-256 of the request, never its text) before it runs. A non-member, or a principal without the authority, gets 403 FORBIDDEN with next_actions (ask an org owner or admin for a role, ask for a grant with the capability, or import the service key), and the same answer whether or not the project exists. A principal PATCH needs project.database.write.