ci: pull the Supabase base image from Docker Hub

The supabase docker jobs failed twice on "toomanyrequests: Data limit
exceeded" while resolving FROM public.ecr.aws/supabase/postgres. Anonymous
ECR Public pulls are charged to a quota keyed on the source IP, which on
GitHub-hosted runners is a NAT pool shared with every other Actions user.

Supabase publishes the same image to Docker Hub. Both tags resolve to the
same manifest index digest -- 17.6.1.170 to sha256:6087b151...6728f and
15.14.1.170 to sha256:bc165447...70b02 -- with linux/amd64 and linux/arm64
on each, so the published images are unchanged. The docker-publish job
already logs in to Docker Hub before it builds, so these pulls are now
authenticated and counted against our own account.

make postgres-supabase-build is unaffected: its sed already rewrites both
spellings of the FROM line to the running Supabase CLI image tag, which
keeps its public.ecr.aws name so the CLI still picks up the rebuilt image.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: andinux

docker/postgresql/Dockerfile.supabase

@@ -46,8 +46,10 @@ RUN mkdir -p /tmp/cloudsync-artifacts/lib /tmp/cloudsync-artifacts/extension &&
         cp /tmp/cloudsync/src/postgresql/migrations/cloudsync--*--*.sql /tmp/cloudsync-artifacts/extension/; \
     fi
 
-# Runtime image based on Supabase Postgres
-FROM public.ecr.aws/supabase/postgres:${SUPABASE_POSTGRES_TAG}
+# Runtime image based on Supabase Postgres. Docker Hub and public.ecr.aws carry
+# the same image; see Dockerfile.supabase.release for why this one is used.
+# make postgres-supabase-build rewrites this line to the running CLI image tag.
+FROM supabase/postgres:${SUPABASE_POSTGRES_TAG}
 
 # Extension version (derived from src/cloudsync.h by the Makefile and passed in
 # as a build arg); used only for the image label.

docker/postgresql/Dockerfile.supabase.release

@@ -19,7 +19,11 @@
 #
 
 ARG SUPABASE_POSTGRES_TAG=17.6.1.170
-FROM public.ecr.aws/supabase/postgres:${SUPABASE_POSTGRES_TAG}
+# Supabase publishes the same image to Docker Hub and to public.ecr.aws; both
+# tags resolve to identical manifest digests. Docker Hub is used here because CI
+# already authenticates to it, while anonymous ECR Public pulls are charged to a
+# data quota shared by every GitHub Actions runner.
+FROM supabase/postgres:${SUPABASE_POSTGRES_TAG}
 
 ARG CLOUDSYNC_VERSION
 ARG TARGETARCH