MAHA Marathon Admin

Volunteer access control — next coding milestone

The database already contains profiles and volunteer_permissions. The next step is Supabase Auth + admin-only volunteer invitation and district-scoped permissions.