feat(cli): port supabase seed buckets to native TypeScript

[Coly010]

Ports supabase seed buckets (CLI-1322) from the Go binary proxy to a native TypeScript implementation in the legacy shell.

What

seed buckets seeds the local Storage stack from supabase/config.toml: it upserts [storage.buckets] (create/update with an overwrite prompt) and [storage.vector] buckets (create/prune with graceful "feature unavailable" skips), then uploads each bucket's objects_path file tree.

Why local-only

Go's seed command is in the local-dev group, so the root pre-run never resolves a project ref (cmd/root.go:108-116) and buckets.Run always receives an empty projectRef. --linked/--local are therefore accepted for surface parity (and their mutual exclusivity is enforced), but seeding always targets the local Storage service gateway. The remote/analytics code paths Go gates on a project ref are unreachable here and are omitted.

Structure

• seed/buckets/ — handler, gateway (Storage service-gateway client: bucket/vector/object endpoints, apikey + Bearer auth), classify (vector graceful-skip detectors), upload (path/content-type helpers), flags (--local/--linked mutual-exclusivity), errors.
• seed/seed.layers.ts — lean runtime (no Management API stack; local-only).
• Local credentials mirror Go's runtime config derivation (@supabase/config decodes the file but doesn't reproduce it): API URL from api.external_url else <scheme>://<SUPABASE_SERVICES_HOSTNAME|127.0.0.1>:<port> (config.go + misc.go:302); service-role key from auth.service_role_key else a JWT signed with auth.jwt_secret (apikeys.go).
• legacy-size-units.ts hoisted to legacy/shared/ (used by config push and seed buckets).

Parity notes for reviewers

• stderr progress strings, prompt wording ([Y/n]/[y/N], overwrite default yes / prune default no), --yes echo, and the two yellow vector WARNING: fall-throughs match Go.
• Object walk mirrors Go's isUploadableEntry (batch.go:65): symlinks detected no-follow; dangling symlinks / symlinks-to-dirs / other non-regular entries are skipped with Skipping non-regular file: (not fatal); symlinked dirs are not descended.
• Request bodies follow Go's omitempty (public *bool, file_size_limit, allowed_mime_types).
• Documented divergence: object Content-Type is extension-based (Go's http.DetectContentType + mime.TypeByExtension is OS-mime-table dependent, so byte-parity isn't achievable). See SIDE_EFFECTS.md.
• --output-format json/stream-json emit a structured run summary; text mode emits nothing extra (Go has no machine output).