Proxy: day + month call counters for an org (Next.js dashboard)

Validates the end-user's Supabase token via auth.get_user (catches revocation; no new dep or secret). Derives the org server-side from the verified email — never trusts a caller-supplied org_id (closes the IDOR). Still gated by X-Internal-Secret as defense-in-depth (only the Vercel proxy reaches this).