Does upsert() support composite keys? It doesn't seem the table editor does

Yes, it does. This is proven to work under PostgREST(can share tests if you like) and supabase-js. It could be a bug on the Table Editor.

Ok, I'll give that a try. I do think there is a bug in the table editor as it keeps complaining no primary key. I opened an issue about it.