ADLC-45: pin @supabase/ssr and @supabase/supabase-js to explicit versions

[eltontay-circle]

Summary

Replaces the floating latest tag on two dependencies with the exact versions already resolved in package-lock.json. This is a pin, not an upgrade — the resolved versions are unchanged.

Package	Before	After
@supabase/ssr	latest	0.8.0
@supabase/supabase-js	latest	2.93.3

Exact versions with no caret, deliberately: a caret range would reintroduce the float this ticket exists to remove.

Verified the pin is not an upgrade — after installing, npm ls reports @supabase/ssr@0.8.0 and @supabase/supabase-js@2.93.3, identical to what latest resolved to before the change.

Jira: https://circlepay.atlassian.net/browse/ADLC-45

Why the lockfile diff is only two lines

Running a plain npm install rewrites package-lock.json by roughly 5,900 lines — re-resolving next (also on latest) and many caret ranges, and dropping/re-adding large parts of the tree.

I confirmed this churn is pre-existing drift, not a side effect of this pin: npm install on a clean, unmodified master checkout produces the same ~5,805 insertion / ~5,967 deletion diff with zero source changes.

Committing that would violate the "no unrelated changes" requirement, so the lockfile edit here is confined to the two matching specifier strings in the root dependencies block. The packages[""].dependencies entries now agree with package.json, and the installed versions already satisfy them.

One related note: because package.json has no name field, npm install also rewrites the lockfile's top-level name to match the working directory. That is another reason the full rewrite was not committed.

Verification

npm run lint — passes, exit 0, zero findings.

npm run build — fails, both before and after this change, for reasons unrelated to it. On a pristine master checkout with no modifications, the build fails identically:

Failed to compile.
./components/ui/checkbox.tsx:22:36
Type error: Cannot find module '@radix-ui/react-checkbox' or its corresponding type declarations.

The failure output on this branch is byte-identical to that baseline, so this PR introduces no regression.

Since the build halts at the first type error, I ran a full tsc --noEmit on both the baseline and this branch to get complete coverage. Both produce the same three errors, all undeclared dependencies:

components/ui/checkbox.tsx(22,36): error TS2307: Cannot find module '@radix-ui/react-checkbox'
components/ui/command.tsx(22,45):  error TS2307: Cannot find module 'cmdk'
components/ui/form.tsx(32,8):      error TS2307: Cannot find module 'react-hook-form'

Notably there are no Supabase-related type errors, which is the meaningful signal that the pinned versions typecheck cleanly against this codebase.

@radix-ui/react-checkbox, cmdk, and react-hook-form are each imported by a components/ui/ file but declared in neither package.json nor the lockfile. Fixing that is outside this ticket's scope, so it is flagged rather than bundled here.

Reviewer notes

• CI will not validate the acceptance criteria. The lint-and-test job in .github/workflows/ci.yml runs only npm install — despite its name it runs neither the build nor the linter, and the scan / release-sbom jobs are commented out. A green check proves only that the tree installs. The lint and typecheck evidence above is from local runs.
• npm ci cannot be used as a gate on this repo: it already fails on unmodified master with a large set of @solana/* "Invalid"/"Missing" mismatches. Also pre-existing and unrelated.
• next remains on latest in package.json — the same class of problem, intentionally left alone per this ticket's scope. Worth a follow-up, and it needs a deliberate compatibility check against eslint-config-next, which is pinned to 15.3.1.