fix: use service-role client for processing_history writes (#289)

appendProcessingHistory was accepting a caller-provided SupabaseClient,
but processing_history has no INSERT RLS policy (by design — audit trail
writes should not be user-controllable). Extension handlers pass the
authenticated user client (ctx.supabase), which caused silent RLS
violations caught by try-catch — the audit trail was wired up but empty.

Switch to creating a service-role client internally, matching the
existing event_log pattern (event-log-handler.ts uses
createServiceClientNoCookies). Remove the supabase parameter from both
appendProcessingHistory and appendProcessingHistoryBatch. Update all
5 call sites in invoice-inbox and inbox-smart-match.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

extensions/general/inbox-smart-match/lib/process-match.ts

@@ -68,7 +68,7 @@ export async function processInboxItemMatch(
   // Append DeterministicMatch event — records that the narrowing ran
   let deterministicEventId: string
   try {
-    deterministicEventId = await appendProcessingHistory(ctx.supabase, {
+    deterministicEventId = await appendProcessingHistory({
       companyId: ctx.companyId,
       correlationId,
       aggregateType: 'MatchProposal',
@@ -121,7 +121,7 @@ export async function processInboxItemMatch(
 
   // Record the LLM attempt in processing_history
   try {
-    await appendProcessingHistory(ctx.supabase, {
+    await appendProcessingHistory({
       companyId: ctx.companyId,
       correlationId,
       causationId: deterministicEventId,

extensions/general/invoice-inbox/index.ts

@@ -68,7 +68,7 @@ async function uploadAndClassify(
 
   // Audit: DocumentIngested
   try {
-    await appendProcessingHistory(supabase, {
+    await appendProcessingHistory({
       companyId,
       correlationId,
       aggregateType: 'Document',
@@ -102,7 +102,7 @@ async function uploadAndClassify(
 
   // Audit: DocumentExtractionAttempted (fires whether classification succeeded or failed)
   try {
-    await appendProcessingHistory(supabase, {
+    await appendProcessingHistory({
       companyId,
       correlationId,
       aggregateType: 'Document',
@@ -190,7 +190,7 @@ async function uploadAndClassify(
   // Audit: DocumentClassified (only when classification succeeded)
   if (!classificationError && classificationResult) {
     try {
-      await appendProcessingHistory(supabase, {
+      await appendProcessingHistory({
         companyId,
         correlationId,
         aggregateType: 'Document',