feat: auth, persistence, and AI integration

- Cookie-based auth via backend proxy (httpOnly JWTs)
- Supabase Postgres persistence for sessions/messages/profiles + RLS
- Fix cross-user session leak (token cache keyed by full token, not 50-char prefix)
- Fix missing table grants (42501) via migration; auto-provision profiles on user creation
- Chat validation, ownership checks, rate limiting, /api/chat/sessions route ordering
- Frontend auth-state reset + credentials include
- OpenRouter AI provider (OpenAI-compatible base URL, reasoning disabled)
- Tests: chatValidation, appState

backend/test/chatValidation.test.js

@@ -0,0 +1,20 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { validateChatInput, isOwnedSession } from "../src/routes/chatValidation.js";
+
+test("accepts a valid chat request", () => {
+  assert.deepEqual(validateChatInput({ text: "hello", grade: "Grade 10", subject: "math" }), { ok: true });
+});
+
+test("rejects invalid metadata and oversized messages", () => {
+  assert.equal(validateChatInput({ text: "hello", grade: "invalid" }).error, "Invalid grade");
+  assert.equal(validateChatInput({ text: "hello", subject: "invalid" }).error, "Invalid subject");
+  assert.equal(validateChatInput({ text: "" }).error, "Message text is required");
+  assert.equal(validateChatInput({ text: "x".repeat(10001) }).error, "Message too long (max 10000 characters)");
+});
+
+test("only the owning user can access a session", () => {
+  assert.equal(isOwnedSession({ user_id: "user-a" }, "user-a"), true);
+  assert.equal(isOwnedSession({ user_id: "user-a" }, "user-b"), false);
+  assert.equal(isOwnedSession(null, "user-a"), false);
+});