Auth: email magic-link sign-in

Added

• middleware.ts (root) — refreshes the Supabase session cookie on every request via updateSession; no-ops when env vars are absent.
• app/auth/confirm/route.ts — magic-link landing route; handles both token_hash+type (verifyOtp) and code (exchangeCodeForSession) email template styles, with same-origin redirect guarding.
• app/auth/signout/route.ts — server-side sign-out (clears cookie).
• lib/auth.tsx — AuthProvider + useAuth() hook wrapping the browser client; exposes user, loading, signInWithEmail, signOut. Degrades to no-op when Supabase isn't configured.
• components/AuthButton.tsx — TopBar control: signed-out shows a magic-link email popover; signed-in shows an avatar + account menu with sign out.

Changed

• app/layout.tsx — wraps the app in <AuthProvider>.
• components/TopBar.tsx — renders <AuthButton /> in the right cluster.

Verified

• tsc --noEmit passes clean. (next lint is unconfigured in this repo and drops to an interactive setup prompt — pre-existing, unrelated.)

Notes / follow-ups

• The default Supabase email template (PKCE code flow) works with the confirm route as-is — no dashboard template edit required. Switching the template to the token_hash style is also supported.
• Auth is currently optional/additive: signing in establishes a session but card data still lives in localStorage + the WS server. Gating spaces/cards on auth.uid() (so RLS applies) is the next step.
• Set the project's Site URL and add …/auth/confirm under Auth → URL Configuration → Redirect URLs in the dashboard so magic links resolve in production (localhost works without it in dev).