fix: add HS256 fallback for JWT verification in local dev

Local GoTrue signs JWTs with HS256, but the JWKS endpoint returns an
empty key set since there are no RSA keys. Fall back to HS256 shared
secret verification when JWKS fails, using SUPABASE_JWT_SECRET.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.beans/nuzlocke-tracker-eg7j--fix-jwt-verification-failing-in-local-dev-hs256-fa.md

@@ -0,0 +1,10 @@
+---
+# nuzlocke-tracker-eg7j
+title: Fix JWT verification failing in local dev (HS256 fallback)
+status: in-progress
+type: bug
+created_at: 2026-03-22T08:37:18Z
+updated_at: 2026-03-22T08:37:18Z
+---
+
+Local GoTrue signs JWTs with HS256, but the JWKS migration only supports RS256. The JWKS endpoint returns empty keys locally, causing 500 errors on all authenticated endpoints. Add HS256 fallback using SUPABASE_JWT_SECRET for local dev.

.beans/nuzlocke-tracker-lkro--ux-make-team-section-a-floating-sidebar-on-desktop.md

@@ -5,11 +5,7 @@ status: todo
 type: feature
 priority: normal
 created_at: 2026-03-21T21:50:48Z
-<<<<<<< Updated upstream
-updated_at: 2026-03-21T22:04:08Z
-=======
 updated_at: 2026-03-22T08:08:13Z
->>>>>>> Stashed changes
 ---
 
 ## Problem