feat: auth, persistence, and AI integration

- Cookie-based auth via backend proxy (httpOnly JWTs)
- Supabase Postgres persistence for sessions/messages/profiles + RLS
- Fix cross-user session leak (token cache keyed by full token, not 50-char prefix)
- Fix missing table grants (42501) via migration; auto-provision profiles on user creation
- Chat validation, ownership checks, rate limiting, /api/chat/sessions route ordering
- Frontend auth-state reset + credentials include
- OpenRouter AI provider (OpenAI-compatible base URL, reasoning disabled)
- Tests: chatValidation, appState

frontend/test/appState.test.js

@@ -0,0 +1,7 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { DEFAULT_APP_STATE, resetAppState } from "../src/appState.js";
+
+test("resetAppState clears user-specific conversation state", () => {
+  assert.deepEqual(resetAppState(), DEFAULT_APP_STATE);
+});