UNLIMITED_VIDEO_USERS bypass has no audit logging and is difficult to rotate #59
Description
The UNLIMITED_VIDEO_USERS environment variable accepts a comma-separated list of emails or user IDs to bypass daily generation limits entirely. As a flat environment variable, there is no audit trail of who is on the list, when they were added, or whether a bypass is actively being used. It also cannot be changed without a redeployment. For a production application, privilege escalation of this kind should be managed via a database-backed profiles flag (e.g., is_unlimited: boolean) that can be toggled at runtime and is logged via Supabase's audit system.