Fix: Add stricter SUPABASE_URL string checking/quote stripping and base64-decode secret in candidate upload helper

Fix: Add robust fallbacks for SUPABASE_URL and SUPABASE_JWT_SECRET to prevent invalid URL errors on Hugging Face space

Allow dynamic CSRF origins and wildcard ALLOWED_HOSTS for Hugging Face deployment

remove SQLite database completely and enforce mandatory remote Supabase database connection

handle database reachability/DNS errors gracefully with automatic SQLite fallback

add database configuration helper to warning logs

minor corrections

Ui and backend changes