Feature/191 checkin token system

[Wuuuuu5]

Summary

• Adds src/services/supabase-admin.ts — a server-only Supabase client using the service role key (never exposed to the browser, guarded with server-only)
• Adds POST /api/admin/checkin/generate — admin-only route (reuses the existing wallet-signature auth pattern from api/admin/approve) that:
  • generates a random token and stores only its SHA-256 hash — raw token is never persisted
  • generates an 8-char short backup code for typed check-in
  • sets a 2-minute expiry
  • revokes any still-active token for the event before inserting a new one, so at most one valid token exists per event
  • resolves the admin's wallet address to their public_profiles.id for audit columns (issued_by/revoked_by)
• Wires the admin QR generator (admin/page.tsx) to call this route and render the real returned token + short code + expiry, replacing the earlier fake client-side token from the QR branch this builds on