Secure sign in

Supabase-backed auth with server session protection for app and admin routes.