fix(mcp-oauth): api_keys.company_id nullable so companyless signups can mint their key (#1919)

Every fresh Claude.ai authorization died at POST /api/mcp-oauth/token
with a silent 500: the multi-tenant refactor's dynamic loop
(20260330130000, line ~250) set company_id NOT NULL on api_keys, and the
companyless key insert from the popup-signup flow (#1814) violates it.
Nothing exercised the real insert before (unit tests mock the client;
no pg test inserted an unbound key), so repo, CI and prod all agreed and
all were wrong. DROP NOT NULL, log the insert/rotation failures at the
token endpoint, and pin the unbound insert + lazy bind on real Postgres.


Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

supabase/migrations/20260826090000_api_keys_company_id_nullable.sql

@@ -0,0 +1,16 @@
+-- Migration: api_keys.company_id becomes nullable
+--
+-- Agent-first onboarding (#1814): a key minted from the OAuth popup before
+-- the user's first company exists is stored unbound (company_id NULL) and
+-- bound lazily by validateApiKey once a company exists. The column was made
+-- NOT NULL by the dynamic loop in 20260330130000_multi_tenant_company_refactor
+-- (line ~250 sets NOT NULL for every table in its list, api_keys included),
+-- which nothing exercised until the companyless flow: the token endpoint's
+-- insert violated it and every fresh Claude.ai authorization died with a 500
+-- ("Authorization with Accounted failed", 2026-08-26).
+--
+-- Consumers already handle NULL: validateApiKey returns companyId
+-- string|null, the MCP dispatcher answers NO_COMPANY_YET for company-scoped
+-- tools on an unbound key, and /api/events fails closed.
+
+ALTER TABLE public.api_keys ALTER COLUMN company_id DROP NOT NULL;