fix(realtime): use a 16-byte DB_ENC_KEY so the container stops crash-looping

disclosure-realtime had been restarting on a ~60 s cycle since the stack was
brought up — RestartCount climbed past 29,000. The seed step crashed with
`{:badarg, 'Bad key size'}` from `:crypto.crypto_one_time(:aes_128_ecb,
"ca2c785fedb0a728dbf2c0e4fcb5d2bf", …)`. The Supabase Realtime image expects
DB_ENC_KEY to be a raw 16-byte key for AES-128-ECB, but VAULT_ENC_KEY (the
value it was being mapped to) is a 32-char hex string — 32 bytes when read
verbatim, which AES-128 rejects.

Fix: separate the realtime key from the Vault key. New env REALTIME_ENC_KEY
holds a fresh 16-byte ASCII string and the compose now maps DB_ENC_KEY to
that. VAULT_ENC_KEY stays untouched for whenever the Postgres Vault
extension is actually used (`vault.secrets` has zero rows, so nothing was
encrypted under the old shared key).

Verified live: realtime restarted clean (Restarts=0, ExitCode=0, stable
across 100 s of polling), seed succeeded (public.tenants now has the
'realtime-dev' row), Tzdata refreshed to 2026b, RealtimeWeb.Endpoint
listening on :4000. The dockerd churn from ~one recreate per second is
gone.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

infra/disclosure-stack/docker-compose.yml

@@ -129,7 +129,12 @@ services:
       DB_USER: supabase_admin
       DB_PASSWORD: ${POSTGRES_PASSWORD}
       DB_NAME: postgres
-      DB_ENC_KEY: ${VAULT_ENC_KEY}
+      # Realtime AES-128-ECB encrypts tenant secrets with this key. The key
+      # must be EXACTLY 16 bytes raw (not 32 hex chars). Sharing VAULT_ENC_KEY
+      # used to crash the container in a tight restart loop because that env
+      # is a 32-char hex string. Kept separate so the Vault extension can keep
+      # its own key shape.
+      DB_ENC_KEY: ${REALTIME_ENC_KEY}
       API_JWT_SECRET: ${JWT_SECRET}
       SECRET_KEY_BASE: ${SECRET_KEY_BASE}
       ERL_AFLAGS: -proto_dist inet_tcp