feat: Feature 1.2 (NBA stats FastAPI service) + Feature 1.4 (database schema)

Feature 1.2: Python FastAPI microservice wrapping nba_api
- GET /stats/season-avg, /stats/last-n, /stats/splits, /players/search
- Redis caching (24hr/1hr/6hr/7day), 0.6s rate limiting, PRA derived stat
- 27 Python tests passing

Feature 1.4: Complete Supabase database schema
- 6 tables: users, picks, scan_sessions, bets, outcomes, performance
- RLS enabled on all tables with auth.uid() policies
- 3 triggers: auto-create user, updated_at, scan count reset
- 37 schema validation tests passing
- Migration SQL ready, pending manual apply (WSL2 DNS blocker)

Total: 92 tests (65 Node.js + 27 Python), all passing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

BLOCKERS.md

@@ -10,10 +10,17 @@
 **Owner:** Kev
 
 ## BLOCKER-002: Auth Provider
+**Status:** RESOLVED (2026-03-21)
+**Decision:** Supabase Auth. See DECISION-004.
+
+## BLOCKER-003: WSL2 Cannot Resolve *.supabase.co Domains
 **Status:** OPEN
-**Impact:** Blocks user system (Feature 1.4+)
-**Options:**
-- Clerk — better DX, faster setup, more expensive at scale
-- Supabase Auth — already in stack, free tier generous, slightly more setup
-**Decision needed by:** Before Feature 1.4 implementation
+**Impact:** Blocks applying Feature 1.4 migration and running verify-schema.js from CLI
+**Details:**
+- WSL2 DNS resolver (10.255.255.254) cannot resolve `*.supabase.co` TLD
+- Google DNS (8.8.8.8) returns NXDOMAIN — may be a new project with DNS propagation delay
+- `*.supabase.com` (e.g., pooler, api) resolves fine
+- Migration SQL is written and validated (37 tests pass)
+**Workaround:** Apply migration via Supabase Dashboard SQL Editor
+**Resolution path:** Either DNS propagates, or add Supabase IP to /etc/hosts, or use `supabase link` with access token via api.supabase.com
 **Owner:** Kev