Phase 1 staging sign-in

Supabase keys are present. The sign-in flow is wired, but access still depends on invite grants in the database.