improve security (change RLS, and allow table sensitive access only at server side, with supabase service key)

package.json

@@ -7,7 +7,8 @@
     "build": "next build --turbopack",
     "start": "next start",
     "lint": "eslint",
-    "lint:fix": "eslint --fix"
+    "lint:fix": "eslint --fix",
+    "test:security": "node scripts/test-security.js"
   },
   "dependencies": {
     "@headlessui/react": "^2.2.7",
@@ -25,6 +26,7 @@
     "@types/xlsx": "^0.0.35",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
+    "dotenv": "^17.2.1",
     "lucide-react": "^0.541.0",
     "next": "15.5.0",
     "nodemailer": "^7.0.5",