perf: cache Supabase admin client as module-level singleton

[Copilot]

Summary

• createAdminClient() previously constructed a fresh SupabaseClient — plus requireServerEnv() + assertExpectedSupabaseProjectConfig() — on every API request. This PR caches it as a module-level singleton, matching the existing openAIClient ??= new OpenAI(…) pattern in openai.ts. The service-role client holds no user-specific state (autoRefreshToken: false, persistSession: false), so sharing across requests is safe.

// before
export function createAdminClient() {
  const { NEXT_PUBLIC_SUPABASE_URL: url, SUPABASE_SERVICE_ROLE_KEY: key } = requireServerEnv();
  return createClient<Database>(url, key, { auth: { autoRefreshToken: false, persistSession: false } });
}

// after
let adminClient: ReturnType<typeof createClient<Database>> | null = null;

export function createAdminClient() {
  if (!adminClient) {
    const { NEXT_PUBLIC_SUPABASE_URL: url, SUPABASE_SERVICE_ROLE_KEY: key } = requireServerEnv();
    adminClient = createClient<Database>(url, key, { auth: { autoRefreshToken: false, persistSession: false } });
  }
  return adminClient;
}

Verification

• npm run verify:cheap — 825/825 tests pass, no new type errors
• npm run verify:ui when UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changed
• npm run verify:release before release or handoff confidence claims
• npm run format:check
• npm run check:production-readiness when clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changed
• npm run check:deployment-readiness when deployment startup, hosting, or rollout behavior changed

Clinical Governance Preflight

Complete this section when the change touches ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output.

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Chosen as the highest-impact / lowest-effort of 10 identified improvements — affects every API route on every request with a 5-line change.
• Other candidates: hoist normalizedClinicalSearchTokens in buildMatchExplanation (Bump actions/setup-node from 4 to 6 #2), remove experimental.cpus: 1 (Bump vitest from 4.1.6 to 4.1.7 #4), parallelise fetchRelatedDocuments (Bump gitleaks/gitleaks-action from 2 to 3 #8).