AI and Integrations are now members-only. The entry points stay visible, but a signed-out click opens a contextual sign-in prompt and then proceeds to the requested feature. (Groundwork for paid plans; payment gateway comes later.)
Added
components/EmailOtpForm.tsx— the email→6-digit-code flow extracted into one reusable component (was inline inAuthButton).components/SignInModal.tsx— centered sign-in wall shown by the gate, with a contextual title/subtitle, reusingEmailOtpForm.
Changed
app/page.tsx—requireAuth(action, gate)runs the action when signed in (or when no Supabase backend is configured — local-first stays open) and otherwise opensSignInModal, running the action on success. Gates the Ask AI FAB, the⌘Kshortcut, the TopBar Connect, and the canvas Open integrations action.components/AuthButton.tsx— now consumes the sharedEmailOtpForminstead of its own inline copy.
Note: when Supabase isn't configured the gate is a no-op (there's no sign-in to require). The server already enforces auth on the credential/Notion routes; this adds the UI wall in front of the features.