#33 feat: claim_songstats_backfill_rows RPC for the backfill worker

What

One SQL function: claim_songstats_backfill_rows(batch_size) — atomically claims pending songstats_backfill_queue rows in rank_score DESC order via FOR UPDATE SKIP LOCKED (inexpressible through supabase-js), marks them in_progress, returns them. Concurrent workers skip each other's locked rows.

Security

SECURITY INVOKER (default) + the table's policy-less RLS: only the service-role worker (RLS-bypassing) gets rows; anon/authenticated callers get zero rows even if they execute it. No SECURITY DEFINER, per the Supabase security checklist.

Why now

Prerequisite for the chat#1791 write-path api PR (cron-started backfill Workflow drains the queue with this claim). Merge order: this → api write path.

🤖 Generated with Claude Code

---

Summary by cubic

Added claim_songstats_backfill_rows(batch_size) SQL RPC to atomically claim pending songstats_backfill_queue rows by rank_score and mark them in_progress, enabling safe concurrent backfill workers via SKIP LOCKED. Prerequisite for chat#1791 write-path backfill; only the service-role can claim rows due to RLS with SECURITY INVOKER.