Phase 12: share an event with co-hosts

The owner shares an event by email; a co-host gets full access inside it
but can't delete it or change who it's shared with. Shares are keyed by
email so an admin can be added before their first login, and RLS (not the
UI) is what enforces the owner-only parts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/check-rls.mjs

@@ -2,7 +2,7 @@
 // Run with: npm run check:rls
 import { createClient } from "@supabase/supabase-js";
 
-const TABLES = ["events", "teams", "games", "criteria", "judges", "scores", "adjustments", "buzzes"];
+const TABLES = ["events", "teams", "games", "criteria", "judges", "scores", "adjustments", "buzzes", "event_cohosts"];
 
 const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
 const anonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;