feat(sprint-4/etapa-2): migración persistencia proceso/grupos/settings a Supabase

- Scripts SQL 002-004: process_groups, processes, app_settings con RLS
- supabaseProcessRepo: save/getById/getAll/delete con mapeo camelCase↔snake_case
  y limpieza Dexie en delete (actividades/gateways/resources/simulations)
- supabaseGroupRepo: save/getAll/getById/delete; FK ON DELETE SET NULL en processes
- supabaseSettingsRepo: get/update sobre fila singleton
- Stores actualizados: library-store y process-store usan repos Supabase para procesos
  (actividades/gateways/recursos siguen en Dexie hasta Etapa 3-4)
- ImportPage y useReportData actualizados a supabaseProcessRepo
- userId inyectado internamente en repos via supabase.auth.getSession() — no se
  threadea por la call stack; stores mantienen interfaces sin cambios
- 561/561 tests verdes, build limpio

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/persistence/supabase/settings-repo.ts

@@ -0,0 +1,27 @@
+import { supabase } from '@/lib/supabase'
+import type { AppSettings } from '@/domain/types'
+
+const DEFAULT_SETTINGS: AppSettings = { id: 'singleton', groupLabel: 'Cliente' }
+
+export const supabaseSettingsRepo = {
+  async get(): Promise<AppSettings> {
+    const { data } = await supabase
+      .from('app_settings')
+      .select('id, group_label')
+      .eq('id', 'singleton')
+      .single()
+    if (!data) return DEFAULT_SETTINGS
+    return { id: 'singleton', groupLabel: (data.group_label as string) ?? 'Cliente' }
+  },
+
+  async update(updates: Partial<Omit<AppSettings, 'id'>>): Promise<void> {
+    const patch: Record<string, unknown> = { updated_at: new Date().toISOString() }
+    if (updates.groupLabel !== undefined) patch.group_label = updates.groupLabel
+
+    const { error } = await supabase
+      .from('app_settings')
+      .update(patch)
+      .eq('id', 'singleton')
+    if (error) throw error
+  },
+}