fix: corregir routing de Vercel y validar variables de entorno de Supabase

- vercel.json: rewrite explícito para /api/* evita que el catch-all SPA intercepte las serverless functions
- supabase.js: lanza error claro si SUPABASE_URL o SUPABASE_SERVICE_ROLE_KEY no están definidas

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/lib/supabase.js

@@ -1,7 +1,11 @@
 import { createClient } from '@supabase/supabase-js'
 
+const url = process.env.SUPABASE_URL
+const key = process.env.SUPABASE_SERVICE_ROLE_KEY
+
+if (!url || !key) {
+  throw new Error('Faltan variables de entorno: SUPABASE_URL y/o SUPABASE_SERVICE_ROLE_KEY')
+}
+
 // Service Role key: bypasea RLS, solo usar en backend
-export const supabase = createClient(
-  process.env.SUPABASE_URL,
-  process.env.SUPABASE_SERVICE_ROLE_KEY
-)
+export const supabase = createClient(url, key)

vercel.json

@@ -5,6 +5,7 @@
     "api/**/*.js": { "maxDuration": 60 }
   },
   "rewrites": [
-    { "source": "/:path*", "destination": "/index.html" }
+    { "source": "/api/(.*)", "destination": "/api/$1" },
+    { "source": "/((?!api/).*)", "destination": "/index.html" }
   ]
 }