feat: operator docs, Gitea push guide, and creatives API scaffold

Unblock ops with marketing@ provisioning steps and start multi-tenant creatives against Supabase RLS.

Co-authored-by: Cursor <cursoragent@cursor.com>

sql/creatives.sql

@@ -0,0 +1,48 @@
+-- Creatives multi-tenant (Supabase)
+-- Run in SQL editor after reviewing names against existing schema.
+
+create table if not exists public.creatives (
+  id uuid primary key default gen_random_uuid(),
+  tenant_id uuid not null references public.tenants(id) on delete cascade,
+  title text not null,
+  status text not null default 'draft'
+    check (status in ('draft', 'in_review', 'approved', 'rejected')),
+  mime_type text,
+  storage_path text,
+  bytes int,
+  sha256 text,
+  created_by uuid references auth.users(id),
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create index if not exists creatives_tenant_idx on public.creatives (tenant_id, updated_at desc);
+
+alter table public.creatives enable row level security;
+
+-- Adjust JWT claim path to match your Auth Hooks
+create policy creatives_tenant_select on public.creatives
+  for select using (
+    tenant_id::text = coalesce(
+      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
+      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
+    )
+  );
+
+create policy creatives_tenant_insert on public.creatives
+  for insert with check (
+    tenant_id::text = coalesce(
+      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
+      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
+    )
+  );
+
+create policy creatives_tenant_update on public.creatives
+  for update using (
+    tenant_id::text = coalesce(
+      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
+      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
+    )
+  );
+
+-- Storage bucket suggestion: creatives (private), path = {tenant_id}/{id}