Good question! not OP but one of the projects here provides a full PG api if you are self-hosting. Presumably the plan is to provide a similar but secure API for supabase hosted instances in future?
Yes, you're right. Eventually we will be adding migrations and a better local dev experience. For now you can use any tool you'd usually use with postgre - dbmate, seqlize etc