feat(web): blog-post ingestion webhook + /blog, dynamic RSS & sitemap

Add an autoblog webhook receiver and a Supabase-backed blog to logicsrc-web
(the app had no Supabase usage before).

- Migration: blog_posts table (RLS: public reads published, service-role
  writes). Applied to the linked project.
- POST /api/webhooks/blog: verifies the Standard Webhooks signature against
  BLOG_WEBHOOK_SECRET via @profullstack/autoblog verifyAndParse (no admin
  user — shared secret only) and upserts the post by slug.
- /blog index + /blog/[slug] render published posts from the table.
- /blog/rss.xml and /sitemap.xml are now dynamic, generated from the table;
  removed the static public/sitemap.xml and public/blog/rss.xml.
- BLOG_WEBHOOK_SECRET added to .env.example.

Verified end-to-end: a signed sample post delivered 200 and appeared in the
index, post page, RSS, and sitemap; build + typecheck pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -28,3 +28,8 @@ UGIG_WEBHOOK_SECRET=
 SH1PT_API_URL=
 SH1PT_API_KEY=
 SH1PT_WEBHOOK_SECRET=
+
+# Shared secret for the blog-post ingestion webhook (no admin user; the
+# webhook authenticates callers by this secret instead). Generate with:
+#   openssl rand -hex 32
+BLOG_WEBHOOK_SECRET=