The first browser auth surface now uses Supabase email and password. Magic-link and OTP login are intentionally disabled for now, and users must already exist in Supabase.

Requires `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, and an existing email / password user in Supabase Auth.