DD-011: make Google login the only way in

Remove the free player selection from /benvenuto: without a Supabase session
no screen renders, and the VITE_AUTH_OBBLIGATORIA bridge flag is gone.
Admin rights now come only from user_roles, so the hardcoded name list in
crapp-data.ts is deleted along with its tests.

Add migration m4_solo_autenticati, which revokes anon access to the v1.0
tables. Apply it only once the whole team has linked an account.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/lib/crapp-data.ts

@@ -169,10 +169,5 @@ export function formatData(iso: string) {
   return d.toLocaleDateString("it-IT", { weekday: "short", day: "2-digit", month: "long" });
 }
 
-/** Referenti che possono gestire eventi e sollecitare le risposte. */
-export const adminNomi = ["Ivan Cacciari", "Iacopo Ricci", "Cristina Titone"];
-
-export function isAdmin(giocatoreId: string) {
-  const g = giocatori.find((x) => x.id === giocatoreId);
-  return Boolean(g && adminNomi.includes(g.nome));
-}
+/* I permessi di amministrazione stanno in `user_roles` (DD-011), non in una lista di nomi:
+   vedi `src/lib/ruoli.ts`. */