fix(deploy): auto-disable prepared statements on Supabase pooler

asyncpg's DuplicatePreparedStatementError fires when running against
PgBouncer in transaction-pool mode (Supabase shared pooler). The
DB_USE_PGBOUNCER env was already wired but easy to forget on deploy.

Auto-detect Supabase pooler from the URL (port 6543 or
pooler.supabase.com host) and force statement_cache_size=0 +
prepared_statement_cache_size=0. Explicit DB_USE_PGBOUNCER=true still
honoured for other PgBouncer deployments.

Fixes: prepared statement "__asyncpg_stmt_1__" already exists during
alembic upgrade head on Render.

services/backend/database.py

@@ -111,7 +111,14 @@ _MAX_OVERFLOW = int(os.getenv("DB_MAX_OVERFLOW", "20"))
 _POOL_TIMEOUT = int(os.getenv("DB_POOL_TIMEOUT", "30"))
 _POOL_RECYCLE = int(os.getenv("DB_POOL_RECYCLE", "1800"))
 _SQL_ECHO = os.getenv("DB_ECHO", "false").lower() == "true"
-_USE_PGBOUNCER = os.getenv("DB_USE_PGBOUNCER", "false").lower() == "true"
+# Auto-detect: any Supabase pooler URL (port 6543 or "pooler.supabase.com" in host)
+# implies pgBouncer transaction mode → prepared statements MUST be disabled.
+# Explicit DB_USE_PGBOUNCER=true still wins for non-Supabase pgBouncer setups.
+_USE_PGBOUNCER = (
+    os.getenv("DB_USE_PGBOUNCER", "false").lower() == "true"
+    or ":6543/" in DATABASE_URL
+    or "pooler.supabase.com" in DATABASE_URL
+)
 
 
 def _create_engine(url: str = DATABASE_URL) -> AsyncEngine: