feat: auth, persistence, and AI integration

- Cookie-based auth via backend proxy (httpOnly JWTs)
- Supabase Postgres persistence for sessions/messages/profiles + RLS
- Fix cross-user session leak (token cache keyed by full token, not 50-char prefix)
- Fix missing table grants (42501) via migration; auto-provision profiles on user creation
- Chat validation, ownership checks, rate limiting, /api/chat/sessions route ordering
- Frontend auth-state reset + credentials include
- OpenRouter AI provider (OpenAI-compatible base URL, reasoning disabled)
- Tests: chatValidation, appState

run-migration.js

@@ -0,0 +1,38 @@
+import pkg from 'pg';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const { Client } = pkg;
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const client = new Client({
+  host: '127.0.0.1',
+  port: 54322,
+  database: 'postgres',
+  user: 'postgres',
+  password: 'postgres',
+});
+
+async function runMigration() {
+  try {
+    await client.connect();
+    console.log('✅ Connected to Supabase Postgres');
+
+    const migrationFile = path.join(process.cwd(), 'supabase/migrations/20260819064500_create_sessions_messages.sql');
+    const sql = fs.readFileSync(migrationFile, 'utf-8');
+
+    // Execute full migration as one transaction
+    await client.query(sql);
+    console.log('✅ Migration applied successfully!');
+
+  } catch (err) {
+    console.error('❌ Migration failed:', err.message);
+    process.exit(1);
+  } finally {
+    await client.end();
+  }
+}
+
+runMigration();