BUG: `evaluate-assessments` Edge Function always returns 500 error from patient app

### Is there an existing issue for this?

- [x] I have searched the existing issues

### What happened?

> This issue and related PR were fully identified and analyzed by myself. Claude was only used to assist with writing descriptions in English.

## 📌 Issue Overview
The `evaluate-assessments` Edge Function always returns `500 Internal Server Error` when submitting an assessment from the patient app. The root cause is twofold: the Edge Function creates a Supabase client with `SUPABASE_ANON_KEY` (anonymous role) which is blocked by RLS policies requiring `authenticated` role, and the Flutter client overrides the `Authorization` header with the anon key instead of forwarding the user's JWT.

## 🔍 Steps to Reproduce
1. Log in as a patient in the patient app
2. Navigate to the Assessments screen
3. Select any assessment (e.g., AQ-10)
4. Answer all questions and submit

## 🎯 Expected Behavior
The assessment should be evaluated, the result saved to `assessment_results` table, and the score returned to the patient.

## 🚨 Actual Behavior

```
FunctionException(status: 500, details: {"error":"Internal Server Error"}, reasonPhrase: Internal Server Error)
```

The Edge Function fails silently because:
1. The Supabase client is created at module level with anon key → DB operations are blocked by RLS
2. The Flutter client explicitly sets `Authorization: Bearer `, overriding the user's JWT that `supabase_flutter` would normally send automatically
3. `patient_id` is taken from the request body instead of the authenticated user's JWT (security issue)
4. No error handling on the `assessment_results` insert operation

## 💡 Suggested Improvements
- Move Supabase client creation inside the request handler with the user's `Authorization` header forwarded
- Use `supabase.auth.getUser()` to extract `patient_id` from the JWT instead of trusting the request body
- Remove the custom `Authorization` header override in the Flutter client — `supabase_flutter` automatically sends the user's JWT via `functions.invoke()`
- Add error handling for the `assessment_results` insert operation

Improvement PR is ready and waiting for #156 been merged and #157 been resolved.

### Record

- [x] I agree to follow this project's Code of Conduct
- [x] I want to work on this issue