Standardize mutation pending states and Supabase error surfaces

[Taleef7]

Context

The gap docs say route-level loading states and many toasts are now in place, but docs/plan-CorvEd.md still calls out partial Supabase error handling, and advisor_update.md notes mutation flows can block without clear progress indicators.

Acceptance criteria

• Inventory student, tutor, and admin forms/server actions for pending UI, disabled submit states, and user-visible errors.
• Ensure Supabase errors are converted to safe, actionable messages instead of raw console-only failures.
• Add focused fixes for high-traffic flows: request creation, package/payment proof submission, admin payment actions, matching, session generation, rescheduling, tutor session update.
• Keep secret/service-role details out of user-visible messages and logs.
• Add tests where behavior can be asserted without brittle UI timing.

References

• docs/plan-CorvEd.md section 4.4 reliability and error handling
• advisor_update.md UX / polish: No loading/optimistic UI for mutations
• docs/GAP_ANALYSIS.md C6 accepted risk