Merge branch 'worktree-supervisor-flags'

Python supervisor + DB-backed feature flags

- supervisor.py replaces supervisor.sh (topological wave scheduling, croniter)
- workflows.toml workflow registry (5 extractors, cron presets, depends_on)
- proxy.py round-robin + sticky proxy rotation via PROXY_URLS
- Feature flags: migration 0019, is_flag_enabled(), feature_gate() decorator
- Admin /admin/flags UI with toggle (admin-only)
- lead_unlock gate on unlock_lead route
- 59 new tests (test_supervisor.py + test_feature_flags.py)
- Fix is_flag_enabled bug (fetch_one instead of execute_fetchone)

# Conflicts:
#	CHANGELOG.md
#	web/pyproject.toml

CHANGELOG.md

@@ -7,6 +7,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [Unreleased]
 
 ### Added
+- **Python supervisor** (`src/padelnomics/supervisor.py`) — replaces `supervisor.sh`;
+  reads `infra/supervisor/workflows.toml` (module, schedule, entry, depends_on,
+  proxy_mode); runs due workflows in topological waves (parallel within each wave);
+  croniter-based `is_due()` check; systemd service updated to use `uv run python`
+- **`workflows.toml` workflow registry** — 5 extractors registered: overpass,
+  eurostat, playtomic_tenants, playtomic_availability, playtomic_prices; cron
+  presets: hourly/daily/weekly/monthly; `playtomic_availability` depends on
+  `playtomic_tenants`
+- **`proxy.py` proxy rotation** (`extract/padelnomics_extract/proxy.py`) — reads
+  `PROXY_URLS` env var; `make_round_robin_cycler()` for thread-safe round-robin;
+  `make_sticky_selector()` for consistent per-tenant proxy assignment (hash-based)
+- **DB-backed feature flags** — `feature_flags` table (migration 0019);
+  `is_flag_enabled(name, default)` helper; `feature_gate(flag, template)` decorator
+  replaces `WAITLIST_MODE`/`waitlist_gate`; 5 flags seeded: `markets` (on),
+  `payments`, `planner_export`, `supplier_signup`, `lead_unlock` (all off)
+- **Admin feature flags UI** — `/admin/flags` lists all flags with toggle;
+  `POST /admin/flags/toggle` flips enabled bit; requires admin role; flash message
+  on unknown flag
+- **`lead_unlock` gate** — `unlock_lead` route returns HTTP 403 when `lead_unlock`
+  flag is disabled
 - **SEO/GEO admin hub** — syncs search performance data from Google Search Console (service
   account auth), Bing Webmaster Tools (API key), and Umami (bearer token) into 3 new SQLite
   tables (`seo_search_metrics`, `seo_analytics_metrics`, `seo_sync_log`); daily background