Supabase self-host wiring: two failures that look like other bugs

Two Supabase config mistakes present as something else entirely. (1) The dashboard offers three connection strings; the transaction pooler on :6543 runs PgBouncer in transaction mode, which is incompatible with asyncpg prepared statements — you get intermittent "prepared statement __asyncpg_stmt_N__ already exists" under load, not at connect time. Use :5432 direct, or the session pooler on :5432 if the direct host is IPv6-only and times out. (2) Backends written against older Supabase decode JWTs with algorithms=[HS256] and a shared secret, but newer projects sign with ES256 asymmetric keys by default, so every request 401s with a generic invalid-token message and nothing names the cause. Detect it before wiring anything: GET <project-url>/auth/v1/.well-known/jwks.json — a non-empty keys array with kty EC or RSA means the project is asymmetric and the HS256 path needs a JWKS patch. Worth writing a preflight script that asserts both plus service_role-vs-anon key placement, since each one otherwise surfaces several commands later.