refactor: 迁移本地 Supabase 到云端，使用 JWKS 进行 JWT 验证

- 新增 JwtVerifier 支持 RS256 + JWKS 验证
- 简化 docker-compose，删除本地 Supabase 服务(kong/auth/storage等)
- 删除冗余的 Supabase 配置文件(volumes目录)
- 适配测试用例以支持新配置方式
- 更新运行时文档和迁移计划

backend/tests/unit/test_settings_supabase_env.py

@@ -1,19 +1,18 @@
 from __future__ import annotations
 
+import pytest
+from pydantic import ValidationError
 from pytest import MonkeyPatch
 
-from core.config.settings import Settings
+from core.config.settings import Settings, SupabaseSettings
 
 
 def test_social_prefixed_supabase_env_populates_settings(
     monkeypatch: MonkeyPatch,
 ) -> None:
-    monkeypatch.setenv("SOCIAL_SUPABASE__PUBLIC_SCHEME", "https")
-    monkeypatch.setenv("SOCIAL_SUPABASE__PUBLIC_HOST", "public.example")
-    monkeypatch.setenv("SOCIAL_SUPABASE__KONG_HTTP_PORT", "8443")
+    monkeypatch.setenv("SOCIAL_SUPABASE__PUBLIC_URL", "https://public.example:8443")
     monkeypatch.setenv("SOCIAL_SUPABASE__ANON_KEY", "anon-key")
     monkeypatch.setenv("SOCIAL_SUPABASE__SERVICE_ROLE_KEY", "service-key")
-    monkeypatch.setenv("SOCIAL_SUPABASE__JWT_SECRET", "jwt-secret")
     monkeypatch.setenv("SOCIAL_SUPABASE__SITE_URL", "https://app.example.com")
     monkeypatch.setenv(
         "SOCIAL_SUPABASE__ADDITIONAL_REDIRECT_URLS",
@@ -27,10 +26,9 @@ def test_social_prefixed_supabase_env_populates_settings(
 
     settings = Settings()
 
-    assert settings.supabase.public_url == "https://public.example:8443"
+    assert str(settings.supabase.public_url) == "https://public.example:8443/"
     assert settings.supabase.anon_key == "anon-key"
     assert settings.supabase.service_role_key == "service-key"
-    assert settings.supabase.jwt_secret == "jwt-secret"
     assert settings.supabase.site_url == "https://app.example.com"
     assert settings.supabase.additional_redirect_urls == [
         "https://a.example.com",
@@ -38,9 +36,63 @@ def test_social_prefixed_supabase_env_populates_settings(
     ]
 
     supabase_settings = settings.model_dump()["supabase"]
-    assert supabase_settings["public_url"] == "https://public.example:8443"
+    assert str(supabase_settings["public_url"]) == "https://public.example:8443/"
     assert supabase_settings["anon_key"] == "anon-key"
     assert supabase_settings["service_role_key"] == "service-key"
-    assert supabase_settings["jwt_secret"] == "jwt-secret"
     assert supabase_settings["site_url"] == "https://app.example.com"
+    assert "jwt_secret" not in supabase_settings
+    assert "public_scheme" not in supabase_settings
+    assert "public_host" not in supabase_settings
+    assert "kong_http_port" not in supabase_settings
     assert settings.database_url == "postgresql+asyncpg://user:pass@db:5432/app"
+
+
+def test_cloud_supabase_env_populates_settings(monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.setenv(
+        "SOCIAL_SUPABASE__PUBLIC_URL", "https://project.example.supabase.co"
+    )
+    monkeypatch.setenv("SOCIAL_SUPABASE__ANON_KEY", "anon-key")
+    monkeypatch.setenv("SOCIAL_SUPABASE__SERVICE_ROLE_KEY", "service-key")
+    monkeypatch.setenv("SOCIAL_SUPABASE__JWT_AUDIENCE", "authenticated")
+
+    settings = Settings()
+
+    assert str(settings.supabase.public_url) == "https://project.example.supabase.co/"
+    assert settings.supabase.jwt_audience == "authenticated"
+    assert settings.supabase.jwt_issuer == "https://project.example.supabase.co/auth/v1"
+    assert (
+        settings.supabase.jwks_url
+        == "https://project.example.supabase.co/auth/v1/.well-known/jwks.json"
+    )
+
+    supabase_settings = settings.model_dump()["supabase"]
+    assert "jwt_secret" not in supabase_settings
+
+
+def test_missing_public_url_raises_validation_error() -> None:
+    with pytest.raises(ValidationError) as exc_info:
+        SupabaseSettings()
+
+    assert "public_url" in str(exc_info.value)
+
+
+def test_public_url_with_trailing_slash_normalizes_correctly(
+    monkeypatch: MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("SOCIAL_SUPABASE__PUBLIC_URL", "https://example.supabase.co/")
+    monkeypatch.setenv("SOCIAL_SUPABASE__ANON_KEY", "anon-key")
+    monkeypatch.setenv("SOCIAL_SUPABASE__SERVICE_ROLE_KEY", "service-key")
+    monkeypatch.setenv("SOCIAL_DATABASE__HOST", "db")
+    monkeypatch.setenv("SOCIAL_DATABASE__PORT", "5432")
+    monkeypatch.setenv("SOCIAL_DATABASE__NAME", "app")
+    monkeypatch.setenv("SOCIAL_DATABASE__USER", "user")
+    monkeypatch.setenv("SOCIAL_DATABASE__PASSWORD", "pass")
+
+    settings = Settings()
+
+    assert settings.supabase.jwt_issuer == "https://example.supabase.co/auth/v1"
+    assert (
+        settings.supabase.jwks_url
+        == "https://example.supabase.co/auth/v1/.well-known/jwks.json"
+    )
+    assert settings.supabase.url == "https://example.supabase.co/"