fix: remove outdated TPB app checklist and viewer role migration SQL

TPB_APP_CHECKLIST.md

@@ -1,58 +0,0 @@
-# TPB App Checklist (Flutter Scope)
-
-This checklist tracks only the Flutter app implementation against `TPB.md`.
-Backend infrastructure (RLS, triggers, storage bucket settings, SQL policies) is intentionally out of scope here.
-
-## 1) Authentication & Onboarding
-
-- [x] Forgot-password entry from login
-- [x] Password-recovery dialog on auth recovery event
-- [x] Ensure default collection on first login
-- [x] Add user as owner/member when creating collection
-
-## 2) Lightning Add (Scanner & Active Collection)
-
-- [x] Persist and restore active collection
-- [x] Scanner supports active collection selection
-- [x] Lookup scanned `hw_id` in `global_cars`
-- [x] Found branch uses bottom sheet + add action
-- [x] New discovery branch captures Name/Series/Year in bottom sheet
-- [x] Insert into `hotwheels` with active collection
-- [x] Insert validation vote flow in app (`car_votes`)
-- [x] Continuous scanner loop / fast next-scan UX
-
-## 3) Private Photo Upload & Processing
-
-- [x] Car detail supports camera capture / update photo
-- [x] Upload path format in app: `uid/entryid.jpg`
-- [x] In-app compression/resizing target (1080px, <=500KB)
-- [x] Save path into `hotwheels.user_image_url`
-
-## 4) Garage Display
-
-- [x] Query cars by active collection
-- [x] Generate signed URLs for private images
-- [x] Fallback to `assets/img/icon_bg_removed.png` when no image
-- [x] Pagination / lazy loading
-- [x] Multi-select move between collections
-- [x] Single-car move action
-
-## 5) Sharing & Collaboration UX
-
-- [x] Invite member by email
-- [x] Remove member flow
-- [x] Leave collection flow (non-owner)
-- [x] Owner guardrails in manage collection flow
-
-## 6) Community Validation & Reporting (App UX)
-
-- [x] Show verification status and confirmation count
-- [x] Confirm catalog entry action from car detail
-- [x] Report catalog issue action with reason + optional note
-- [x] Prevent duplicate open report submission per user/car in app flow
-- [x] My Reports screen with status display (open/reviewed/resolved/dismissed)
-
-## Current App-Only Verdict
-
-- App-side TPB implementation is complete for the defined Flutter workflows.
-- Any further remaining TPB work should now be treated as either backend operations or new product scope.

VIEWER_ROLE_MIGRATION.sql

@@ -1,64 +0,0 @@
--- Run in Supabase SQL Editor.
--- 1) Allow viewer role
-alter table public.collection_members
-  drop constraint if exists collection_members_role_check;
-
-alter table public.collection_members
-  add constraint collection_members_role_check
-  check (role in ('owner', 'member', 'viewer'));
-
--- 2) Ensure owners can delete members from their collections
---    (and users can still remove themselves for leave flow).
-drop policy if exists "Owner can remove members" on public.collection_members;
-
-create policy "Owner can remove members"
-on public.collection_members
-for delete
-to authenticated
-using (
-  collection_id in (
-    select c.id
-    from public.collections c
-    where c.owner_id = auth.uid()
-  )
-  or user_id = auth.uid()
-);
-
--- 3) Stable, policy-safe removal RPC for app use
-create or replace function public.remove_collection_member(
-  p_collection_id uuid,
-  p_member_user_id uuid
-)
-returns void
-language plpgsql
-security definer
-set search_path = public
-as $$
-declare
-  v_owner_id uuid;
-begin
-  select c.owner_id
-    into v_owner_id
-  from public.collections c
-  where c.id = p_collection_id;
-
-  if v_owner_id is null then
-    raise exception 'Collection not found.';
-  end if;
-
-  if v_owner_id <> auth.uid() then
-    raise exception 'Only the collection owner can remove members.';
-  end if;
-
-  if p_member_user_id = v_owner_id then
-    raise exception 'Collection owner cannot be removed.';
-  end if;
-
-  delete from public.collection_members cm
-  where cm.collection_id = p_collection_id
-    and cm.user_id = p_member_user_id
-    and cm.role <> 'owner';
-end;
-$$;
-
-grant execute on function public.remove_collection_member(uuid, uuid) to authenticated;