fix(edge-fn): replace getClaims with adminClient.auth.getUser(token)

fix(edge-fn): use user.id instead of claims.sub; fixes 500s and false cert_required
fix(migrations): drop broad reservations SELECT policy; add reservation_slots view with security_invoker=false
fix(tests): correct weekSlot() keys from start/end to start_time/end_time
fix(tests): spread overlap test slots across separate ISO weeks
fix(tests): update e2e assertion to match actual authenticated home text
fix(app): hide IonMenu before user is authenticated
feat(dx): add test:all script running unit, integration, and e2e in sequence
docs(claude-md): document SELinux fix, Edge Function auth pattern, security_invoker behaviour

tests/e2e/auth.spec.ts

@@ -35,7 +35,7 @@ test.describe('Auth flow', () => {
 
     // Auth callback redirects to home (authenticated state)
     await expect(page).toHaveURL('/')
-    await expect(page.getByText('Welcome to OYS Borrow a Boat')).toBeVisible()
+    await expect(page.getByText('Upcoming Reservations')).toBeVisible()
   })
 
   test('unauthenticated access to protected route redirects to splash', async ({ page }) => {