Module-level SDK client init turns a missing env var into a white screen

A Supabase client was constructed at module scope, and that module was imported by the route table. createClient() throws on an empty URL, so an unset env var did not degrade sign-in — it took down the entire SPA to a blank page with one console error, including routes that needed no auth at all. Any SDK whose constructor validates its arguments has this shape: the failure escalates from scoped to total because of where the import sits in the graph. Fix is to fall back to an obviously-invalid-but-well-formed value (e.g. an unreachable origin) plus a loud warning, so the shell still renders and the failure stays confined to calls that actually use the client.