UX: friendlier self-host errors when Supabase schema/RLS is missing

[telivity-otaip]

Why

When web/config.js points at a project without CareerOps tables (or RLS blocks reads), the SPA often fails in the console with opaque PostgREST errors. Self-hosters think the app is broken; maintainers get the same Discord/GitHub loop.

Size

M — detect common failure shapes + surface one clear status/banner.

Task

1. Identify the first queries after login (mt_profiles, mt_roles, …) in web/ui/state.mjs.
2. When the error looks like missing relation / permission denied / invalid API key, show a short in-UI message that points to:
   • web/config.js setup
   • apply supabase/schema.sql (or migrations)
   • docs/TROUBLESHOOTING.md once #23 lands (link web/README.md / web/SCHEMA.md until then)
3. Keep the message honest — no “contact support”, no leaking stack traces with tokens.

Acceptance

• Fresh project with wrong/missing schema shows an actionable banner/status, not only console.warn
• Happy path (working demo/self-host) unchanged
• No secrets logged
• npm test passes

Out of scope

Auto-migrating a remote database from the browser; shipping a hosted wizard.