feat: auth, persistence, and AI integration

- Cookie-based auth via backend proxy (httpOnly JWTs)
- Supabase Postgres persistence for sessions/messages/profiles + RLS
- Fix cross-user session leak (token cache keyed by full token, not 50-char prefix)
- Fix missing table grants (42501) via migration; auto-provision profiles on user creation
- Chat validation, ownership checks, rate limiting, /api/chat/sessions route ordering
- Frontend auth-state reset + credentials include
- OpenRouter AI provider (OpenAI-compatible base URL, reasoning disabled)
- Tests: chatValidation, appState

supabase/migrations/20260819120000_grant_api_role_table_access.sql

@@ -0,0 +1,24 @@
+-- Grant table privileges to Supabase API roles.
+--
+-- The sessions/messages/profiles tables are owned by `postgres`, and the
+-- default ACL for postgres-owned tables omits SELECT/INSERT/UPDATE for the
+-- PostgREST API roles (anon/authenticated/service_role). This caused
+-- PostgreSQL error 42501 ("permission denied for table ...") on every
+-- database operation through the REST gateway.
+--
+-- RLS remains enabled and is the actual access control; these grants only
+-- allow the roles to reach the tables through PostgREST. service_role also
+-- carries BYPASSRLS, which is the backend's write path.
+
+GRANT SELECT, INSERT, UPDATE, DELETE
+  ON public.profiles,
+     public.sessions,
+     public.messages
+  TO anon, authenticated, service_role;
+
+-- Ensure future tables created in `public` receive the same grants, so the
+-- "always-revoked" default (auto_expose_new_tables) does not silently break
+-- new tables the same way.
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES
+  TO anon, authenticated, service_role;