feat: auth, persistence, and AI integration

- Cookie-based auth via backend proxy (httpOnly JWTs)
- Supabase Postgres persistence for sessions/messages/profiles + RLS
- Fix cross-user session leak (token cache keyed by full token, not 50-char prefix)
- Fix missing table grants (42501) via migration; auto-provision profiles on user creation
- Chat validation, ownership checks, rate limiting, /api/chat/sessions route ordering
- Frontend auth-state reset + credentials include
- OpenRouter AI provider (OpenAI-compatible base URL, reasoning disabled)
- Tests: chatValidation, appState

docs/superpowers/plans/2026-08-19-session-security-fixes.md

@@ -0,0 +1,58 @@
+# Session Security and Persistence Fixes Implementation Plan
+
+> **For agentic workers:** Execute inline with test-first checkpoints.
+
+**Goal:** Remove cross-user stale chat exposure, verify existing persistence/rate limits, and close remaining backend validation gaps.
+
+**Architecture:** Keep the existing backend Supabase service and explicit ownership checks. Reset all frontend conversation state on every auth transition. Move the chat-session listing route before the parameterized chat route. Add deterministic backend tests for validation and ownership helpers.
+
+**Tech Stack:** Express 5, Supabase JS, React 19, Vite, Node test runner.
+
+## Global Constraints
+
+- Do not expose service credentials to frontend code.
+- Keep explicit `req.user.uid` ownership checks even when using the service-role client.
+- Do not update React state during render.
+- Verify each behavioral change with a focused test or runtime smoke check.
+
+### Task 1: Backend route and validation coverage
+
+**Files:**
+- Create: `backend/src/routes/chatValidation.js`
+- Create: `backend/test/chatValidation.test.js`
+- Modify: `backend/src/routes/chat.js`
+
+- [ ] Write failing tests for valid/invalid metadata, empty/oversized text, and owned/unowned session decisions.
+- [ ] Run `node --test backend/test/chatValidation.test.js` and confirm the missing helper fails.
+- [ ] Implement minimal pure validation/ownership helpers.
+- [ ] Use helpers in the chat POST path and preserve 404 ownership behavior.
+- [ ] Run the focused test and confirm pass.
+
+### Task 2: Frontend auth transition cleanup
+
+**Files:**
+- Create: `frontend/src/appState.js`
+- Create: `frontend/test/appState.test.js`
+- Modify: `frontend/src/App.jsx`
+
+- [ ] Write failing tests for reset state after sign-out and sign-in.
+- [ ] Run the focused test and confirm failure.
+- [ ] Implement a pure reset-state helper and call it from the auth effect, aborting active requests and clearing sessions on sign-out.
+- [ ] Keep reset side effects inside `useEffect`, not render.
+- [ ] Run the focused test and frontend build.
+
+### Task 3: Route ordering and existing infrastructure verification
+
+**Files:**
+- Modify: `backend/src/routes/chat.js` only if needed.
+
+- [ ] Place `GET /sessions` before `GET /:chatId`.
+- [ ] Verify rate-limit middleware is installed and mounted on auth/chat/sessions.
+- [ ] Verify migration and database service configuration without committing credentials.
+- [ ] Run backend syntax/tests and frontend build.
+
+### Task 4: Runtime verification
+
+- [ ] Start local Supabase/backend/frontend where available.
+- [ ] Exercise health, unauthorized protected routes, rate-limit boundary, and browser sign-out/sign-in state reset.
+- [ ] Report exact observed outputs and any unavailable checks.