fix: make cli-minimal self-host bootstrap real

[shuxueshuxue]

Summary

This closes the real self-hosted deploy/cli-minimal bootstrap gap found by PGL Ubuntu YATU.

Two root causes surfaced through the public CLI path:

1. SUPABASE_ANON_KEY and LEON_SUPABASE_SERVICE_ROLE_KEY cannot be opaque random strings. PostgREST expects JWTs signed by SUPABASE_JWT_SECRET.
2. Plain PostgreSQL bootstrap created Supabase-style roles but did not grant service_role access to the app-owned schemas, so the backend storage client reached PostgREST and then failed with permission denied for schema identity.

The fix keeps the architecture thin:

• add deploy/cli-minimal/generate-env.py to generate a local compose env with PostgREST-compatible JWTs
• extend scripts/apply_app_schema.py --prepare-supabase-roles to grant service_role usage/all privileges across manifest app-owned schemas
• keep deploy/cli-minimal on the formal app schema/init path; no local schema fork and no guest/auth API special case
• clean schema checker wording so it enforces a flat manifest-owned schema tree instead of carrying the old canonical incident name

Verification

Local:

• uv run pytest tests/Unit/storage/test_app_schema_discipline.py tests/Unit/storage/test_app_schema_applier.py tests/Unit/backend/test_local_communication_deploy.py -q -> 20 passed
• uv run ruff format --check scripts/check_app_schema.py scripts/apply_app_schema.py deploy/cli-minimal/generate-env.py tests/Unit/storage/test_app_schema_discipline.py tests/Unit/storage/test_app_schema_applier.py tests/Unit/backend/test_local_communication_deploy.py
• uv run ruff check scripts/check_app_schema.py scripts/apply_app_schema.py deploy/cli-minimal/generate-env.py tests/Unit/storage/test_app_schema_discipline.py tests/Unit/storage/test_app_schema_applier.py tests/Unit/backend/test_local_communication_deploy.py
• uv run pytest -q -> 2209 passed, 8 skipped

YATU on PGL Ubuntu with fresh clone + Docker Compose + fresh PyPI CLI:

• started deploy/cli-minimal with generated env
• cel 0.1.54
• cel connect http://127.0.0.1:18442 --json returned OpenAPI/capabilities
• cel guest --json created a guest owner
• cel agent external create cli-minimal-yatu-agent --name "CLI Minimal YATU Agent" --provider codex --json created an external identity
• cel self status --json showed the local backend URL, guest owner, and identity
• remote compose containers, volume, and temp workdir were removed after proof