Rebuild the community feed around verified businesses

[arka97]

What changed

Open business community

• Rebuilt /market as a publicly readable business community.
• Removed the seven-day trial, paid-member engagement gate and full-screen paywall overlays.
• Reading posts, comments, aggregate reactions and closed poll results no longer requires membership.
• Posting, commenting, reacting and voting require an approved, visible, verified business.
• Added clear sign-in, registration and review-status guidance for users who cannot participate yet.

Business attribution

• Public posts and comments now display the business identity from companies_public, not the individual profile name.
• Business logos, country, verification state and storefront links are used consistently.
• Personal user IDs remain the accountable backend author but are not presented as the public identity.
• Post owners may delete their own posts; administrators may hide or delete.
• Community moderation now operates on businesses rather than personal-profile names.

Anonymous publishing retired

• Removed anonymous posting from the composer.
• Historical anonymous posts are hidden during migration.
• The database trigger forces every new post to is_anonymous = false, including old administrator tooling.
• The anonymous identity log remains read-only historical audit data for administrators.
• Removed the obsolete paid/anonymous PaywallOverlay component.

Feed scope

New business posts support:

• discussion
• indicative price signals
• market alerts
• business updates
• polls
• public images and PDF attachments

New sourcing asks are deliberately removed from the feed composer. Structured sourcing requirements belong in RFQs, private quotations and deal rooms. Existing legacy sourcing posts continue to render with a migration notice.

Poll and engagement privacy

• Poll voting is handled by a verified-business RPC.
• Browsers receive aggregate option counts and whether the current user voted; voter identity rows are not selectable.
• Likes, views and comments are aggregated through a public-safe RPC.
• Guests can open and read comments while only verified businesses may add comments or react.
• Browser clients no longer submit trusted author, voter or viewer user IDs.

Database and RLS

• Replaced legacy paid/trial/anonymous policies across community posts, comments, likes, views, polls, options, votes and the anonymous log.
• Public reads are separated from administrator oversight policies so anonymous requests never depend on role-check execution.
• Direct business-user writes are revoked; validated SECURITY DEFINER RPCs own post, comment, like, view and vote writes.
• Preserved a narrow admin-only insert path for association rate updates and admin polls.
• Replaced every legacy community-media storage policy before installing the final public-read / verified-upload / owner-delete set.
• Added hard abuse guards:
  • 10 community posts per hour per non-admin author
  • 60 comments per hour per non-admin author
  • 5,000-character posts
  • 1,500-character comments
  • polls limited to 2–4 unique options and 1–14 days

New RPCs

• has_verified_business()
• create_business_post(...)
• create_business_poll_post(...)
• add_business_comment(...)
• set_business_post_like(...)
• record_business_post_view(...)
• cast_business_poll_vote(...)
• get_business_poll(...)
• get_business_post_engagement(...)

Product boundary

This PR does not add:

• personal social profiles
• anonymous publishing
• direct contact details
• order acceptance
• purchase orders
• payments or escrow
• logistics or fulfilment
• public voter identities

The feed is a public business-information surface. Commercial transactions remain in RFQs, private quotations and deal rooms.

Lovable impact

This PR contains three Supabase migrations and requires generated-type refresh.

Migration order:

1. 20260720100000_business_community_feed.sql
2. 20260720100100_lock_community_read_and_storage.sql
3. 20260720100200_community_admin_and_rate_guards.sql

After applying them, Lovable must regenerate src/integrations/supabase/types.ts and replace the temporary communityRpc.ts adapter with typed supabase.rpc(...) calls across the community repositories.

Validation completed

• Branch is 29 commits ahead of main and 0 behind.
• 22 focused files changed.
• Static review completed for public/business identity separation, poll voter privacy, direct-write revocation, public comment reading, storage-policy replacement, admin publishing compatibility and abuse limits.
• Local Lovable build, migration execution, generated-type refresh and live RLS tests were not available in this execution environment.

Mandatory Lovable checklist

1. Apply migrations and regenerate types

• Apply all three migrations in the stated order.
• Confirm all nine RPCs exist.
• Regenerate Supabase types.
• Remove src/repositories/communityRpc.ts.
• Replace all temporary community RPC calls with generated typed supabase.rpc(...) calls.
• Run TypeScript, production build, lint and tests.

2. Public read

As an anonymous visitor:

• /market loads visible non-anonymous posts.
• Comments can be opened and read.
• Business names/logos/countries come from companies_public.
• Hidden and historical anonymous posts are not returned.
• Like/comment/view counts are readable.
• Poll option totals are shown only after poll close; voter IDs cannot be queried.
• Public community media can be viewed.
• No post, comment, reaction or vote write succeeds.

3. Verified-business participation

Test approved verified Business A:

• Creates discussion, price signal, alert, business update and poll posts.
• Uploads JPG/PNG/WEBP/GIF and PDF within limits.
• Comments, likes and votes.
• Deletes its own post.
• Cannot create anonymous content.
• Cannot create a new sourcing-ask feed post.

4. Invalid business states

Test account without business, pending business, rejected business, hidden business and unverified business:

• Can read public feed and comments.
• Cannot create posts, comments, likes or votes.
• Cannot upload to community-media.
• Direct table inserts/updates/deletes fail except explicitly permitted owner/admin deletes.

5. Cross-business and privacy tests

Use Businesses A, B and C:

• A posts and comments.
• B and C see A’s business identity, never A owner’s personal profile name.
• B and C cannot query post_poll_votes or voter IDs.
• B can vote; C sees no indication of B’s identity.
• A cannot submit a forged author_id for B.
• B cannot submit a forged commenter, liker, viewer or voter user ID.
• All write identity comes from auth.uid() inside RPCs.

6. Administrator compatibility

• Admin can read hidden posts and comments.
• Admin can hide, restore and delete posts.
• Existing association rate-update tooling can still insert admin-authored rate posts.
• Admin-created posts are also forced to identified mode.
• Historical anonymous audit log remains read-only.

7. Abuse and media guards

• 11th non-admin post within one hour is rejected.
• 61st non-admin comment within one hour is rejected.
• Post over 5,000 characters is rejected.
• Comment over 1,500 characters is rejected.
• Poll with duplicate, fewer than 2 or more than 4 options is rejected.
• Poll outside 1–14 days is rejected.
• Unverified upload is rejected.
• Upload outside posts/{auth.uid()}/... is rejected.
• A user cannot delete another user’s community-media object.

8. UI review

Test desktop and mobile:

• /market
• topic filters
• composer modes
• image/PDF rendering
• comments sheet
• polls before and after voting/closing
• moderation community tab
• historical anonymous audit tab

Do not merge until migrations, generated types, build and public/verified/admin RLS tests pass.