Captain

Supabase Auth — no custom auth (security.md)