db/workflows: hodler verify + token balances RLS

[youngkidwarrior]

Why:
- Track SEND balances and hodler verification to support rewards
  logic while preserving precision.
- Keep balances/weights as string|bigint end‑to‑end to avoid Number
  coercion and on‑chain precision loss.
- Use a token_key for reliable upserts (ERC‑20 and native) under a
  single unique key; avoid NULL‑uniqueness pitfalls and complex
  partial indexes.
- Update only on deposits in receive triggers; internal transfers are
  handled by workflows, preventing double counting.
- Do not backfill send_token_hodler into past distributions; require
  it only for new distributions (id >= 21).

Changes:
- Temporal workflows
  - Add readBalanceActivity and persistBalanceActivity (SEND‑only,
    gated via base chain and sendTokenAddress).
  - Add upsertSendTokenHodlerVerificationActivity and apply to both
    sender and receiver post‑confirmation.
  - Fix dvError handling; remove stray casts; wire error handling via
    isRetryableDBError.
- Types & lint
  - Widen Supabase overrides so writes accept number|string|bigint for
    token_balances.balance and distribution_verifications.weight; keep
    generated Row types as number.
  - Remove problematic casts/usages; escape quotes; simplify imports;
    fix onScrub prop usage; yarn lint passes cleanly.
- Schema & migrations
  - Create token_balances with RLS, generated token_key, and unique
    (user_id,token_key) for simple upserts; add helpful indexes.
  - Add deposit‑only trigger on send_account_receives to upsert native
    balances; exclude internal transfers (sender is a Send Account).
  - Fix backfill CTE scope (eth_dep) to avoid relation errors; keep
    new hodler backfill a no‑op.
- Tests
  - Add pgtap test asserting send_token_hodler exists for all
    distributions with id >= 21.

Test plan:
- yarn lint → no errors.
- yarn supabase test → distribution_send_token_hodler_test passes; other
  tag tests remain unchanged.
- Manual: run a SEND transfer; verify:
  - token_balances upserted for both addresses (correct user, chain,
    token/native), RLS allows owner to read.
  - distribution_verifications upserted for both parties with type
    send_token_hodler and weight preserved as string|bigint.

[youngkidwarrior]

• db/workflows: hodler verify + token balances RLS #2001 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Vercel Unique URL: https://sendapp-qjkfhz9rq-0xsend.vercel.app
Vercel Preview URL: sendapp-temporal-driven-send-balances-hodler-dv-0xsend.vercel.app
Last Commit: 13989b0