chore(deploy): showcase on Vercel + Supabase with the AI service on Vercel and a Gemini free-tier key (exception)

[Fluory]

Goal

Deploy the public showcase (epic #19) on the orchestrator's accounts: web app on Vercel + Supabase (eu-central-1), AI service also on Vercel as a Python function (spike), model calls through a Gemini API free-tier key as a temporary, documented exception.

Decisions (orchestrator, 2026-09-26)

• Gemini API free-tier key for the showcase first – a temporary exception to ADR-0001 D8 (the Gemini API terms require paid services for API clients offered to users in the EEA; free-tier content may be human-reviewed). Conditions: invite-only demo accounts, synthetic data only, demo banner; switch to a paid tier or Vertex before anyone outside the orchestrator gets access.
• AI service host: Vercel Python function first (spike). Measure build size, cold start and one extraction; fallback decided on the measured result.

Acceptance criteria

• ADR-0001 amendment (D8 exception + D11 AI-service host), exceptions register entry with expiry condition, AGENTS.md project specifics and docs/technical/deployment-vercel.md updated in the same PR
• services/ai deploys on Vercel via [tool.vercel] entrypoint; spike result (bundle size, cold start, one extraction) recorded in the PR
• Supabase project in eu-central-1: roles app_owner/app_rw without superuser/BYPASSRLS, private bucket, migrations applied, demo accounts seeded
• Web app on Vercel with all variables from the runbook; no secret ever in the repo, an issue, a PR or the chat
• Smoke check from the runbook (§8) passes, including one synthetic request from upload to Exportiert

Not part of this task

• Custom domain, paid plans, Vertex/GCP, OCR on the showcase (AI_PDF_OCR=off)

Test plan

Criterion	Check
entrypoint	pytest: importing the Vercel entry module yields the FastAPI app
deployment	runbook §8 smoke check, results in the PR
roles	select rolsuper, rolbypassrls on Supabase = f, f

Security/Privacy affected?

Yes – public deployment, secrets handling, a free-tier model provider (exception). Synthetic data only.

[Fluory]

Claimed by @Fluory on branch claude/chore-showcase-deploy-67 (local session with Vercel + Supabase access).