feat(auth): migrate authentication layer to Supabase

[cH0NKIIs34L]

Summary

Replace the Express/JWT/Passport auth stack with Supabase Auth so the
client handles authentication directly without a backend relay layer.

What Changed

• client/src/modules/api/auth/auth.api.js — rewrote all four methods
  (signup, login, logout, checkStatus) to use Supabase Auth SDK directly
• client/src/providers/AuthProvider/AuthProvider.jsx — replaced
  fetch-based session polling with onAuthStateChange subscription and
  public.users profile fetch on SIGNED_IN
• client/src/components/Forms/LoginForm/LoginForm.jsx — updated to
  consume { error } from AuthProvider.login() and added isSubmitting state
• client/src/components/Forms/SignupForm/SignupForm.jsx — updated to
  consume { error } from authApi.signup() and added isSubmitting state

---

What

This PR replaces the entire client-side auth layer — authApi, AuthProvider,
LoginForm, and SignupForm — with equivalents that talk directly to Supabase
Auth instead of the Express backend.

Why

The migration to Supabase makes the Express auth endpoints (sign-up,
log-in, log-out, /me) redundant. Keeping the old fetch-based auth
layer would leave the app broken once those endpoints are removed in
Epic 4 (server cleanup), so auth must be migrated first.

How

• authApi now wraps Supabase SDK methods instead of fetch — the public
  surface (signup, login, logout, checkStatus) is preserved so callers
  need minimal changes
• Username-to-email mapping uses the username@app.local convention
  since Supabase Auth requires an email; username is stored in
  user_metadata so the DB trigger can populate public.users
• AuthProvider subscribes to onAuthStateChange on mount and
  unsubscribes on unmount — this replaces the manual checkAuthStatus
  poll and means the client reacts to session changes in real time
• On SIGNED_IN, the provider fetches the user's public.users row to
  get username and role, since Supabase Auth itself only holds email
• getSession() is called on mount to rehydrate from localStorage before
  the first auth event fires, preventing a flash of unauthenticated state
• AuthProvider.login() is now the single call site for sign-in in
  LoginForm — the form no longer calls authApi directly, keeping the
  sign-in flow consistent with how logout and session sync work
• Both forms now track isSubmitting to disable the submit button during
  async calls, preventing duplicate submissions
• response.ok / response.json() patterns are fully removed from both
  forms — all error handling now reads from { error } returned by the
  Supabase SDK

---

Pre-Merge Checklist

• Synced with main before opening this PR
• All tests pass locally (npm test in both client/ and server/)
• No console.log left in production code
• Self-reviewed my own diff before requesting review
• Added or updated tests for the changes made
• No new ESLint errors (npm run lint)