Add Supabase Auth multi-user isolation

[leini8891]

Summary

• Add Supabase SSR auth for email/password sign up, login, callback, and sign out in apps/web.
• Protect dashboard pages and API routes, deriving candidateId from the signed-in user's auth.uid() instead of default candidate ids or request headers.
• Route normal server/database access through request-scoped anon clients carrying the user's JWT so RLS applies, while keeping the service-role helper only for trusted admin/background use.
• Add RLS/storage migration for authenticated table access, per-user job ownership, private asset bucket access, and isolated paths under resumes/{uid}/..., tailored-resumes/{uid}/..., and receipts/{uid}/....
• Keep no-Supabase local single-user mode working through the existing local JSON store fallback.

Supabase configuration

Required env for multi-user mode:

NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=your_publishable_key
SUPABASE_STORAGE_BUCKET=applypilot-assets

NEXT_PUBLIC_SUPABASE_ANON_KEY is still accepted for older projects. SUPABASE_SECRET_KEY / SUPABASE_SERVICE_ROLE_KEY should only be configured for trusted admin or background operations; normal web requests use the signed-in user's JWT.

In Supabase Auth, enable email/password sign-in and add this local redirect URL:

http://localhost:3000/auth/callback

Apply migrations in order, including:

supabase db push

supabase/migrations/0003_auth_rls_storage_isolation.sql updates Data API grants, RLS policies, job ownership, and Storage policies for user-isolated asset paths.

Local test steps

1. Run pnpm install if dependencies changed locally.
2. Run pnpm dev:web and open http://localhost:3000/login.
3. With Supabase env configured, create account A, save a job or upload a resume, sign out, then create account B and confirm account A's rows/assets are not visible.
4. Remove Supabase env values and restart pnpm dev:web; the app should run in local single-user mode using local_workspace/applypilot-store.json.

Verification

pnpm lint && pnpm test && pnpm build

Passed locally: 6 test files, 25 tests.