fix: review-driven hardening — env guards, token expiry, slug validation, dashboard UX

From CEO plan review:
- Edge functions: early guard on missing env vars instead of non-null assert crash
- cli-team: wire isTokenExpired check (was imported but unused)
- Migration 007: CHECK constraint on team slug (a-z0-9 hyphens, 2-50 chars)
- Dashboard: streak badges on leaderboard, repo slug in who's-online,
  contextual empty states that teach, 60s refresh (was 30s)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/cli-team.ts

@@ -35,6 +35,11 @@ async function getValidToken(): Promise<{ token: string; config: ReturnType<type
     return null;
   }
 
+  if (config.auth.expires_at && isTokenExpired(config.auth.expires_at)) {
+    console.error('Auth token expired. Run: gstack sync setup');
+    return null;
+  }
+
   return { token, config };
 }