Supabase gateway requires the service role key in the 'apikey' header
for authentication when the key uses the new sb_secret_ format (not JWT).
Previously only sent via Authorization Bearer, which the gateway rejected.
Root cause: the COACH_FRONT state was being saved inside setTimeout,
creating a race condition where the next message arrives before state
is persisted. Now state is saved synchronously before returning.
Also added a safety guard that re-reads state from DB right before
entering Food Scan flow, making it impossible for coach photos to
be incorrectly processed as food.
Menu simplified to two clear options: Analisar Prato / Coach Corporal.
