feat(auth): add Supabase auth with Google, GitHub, and email OTP login

Introduce user registration/login gated behind optional NEXT_PUBLIC_SUPABASE_*
env vars (leave blank to disable — app behaves exactly as before). Adds
proxy.ts for automatic cookie session refresh, requireUser() API route
guards on all 7 compute-consuming routes, AuthModal (Google/GitHub OAuth +
6-digit email OTP), UserChip header component, and login_success analytics
event. Identity is fully decoupled from Session/engine — no type changes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/analytics.ts

@@ -54,6 +54,7 @@ type AnalyticsEventData = {
   fullscreen_toggle: { on: boolean };
   play_heartbeat: never;
   gallery_export: { scene_count: number; audio_count: number };
+  login_success: { provider: "google" | "github" | "email" };
 };
 
 export type AnalyticsEvent = keyof AnalyticsEventData;

lib/engineClient.ts

@@ -31,6 +31,13 @@ function getClientConfig(): EngineConfig | null {
   return resolveEngineConfig(modelCfg, ttsCfg);
 }
 
+export class AuthRequiredError extends Error {
+  constructor() {
+    super("Unauthorized");
+    this.name = "AuthRequiredError";
+  }
+}
+
 async function postJson<T>(path: string, body: unknown): Promise<T> {
   const res = await fetch(path, {
     method: "POST",
@@ -38,6 +45,7 @@ async function postJson<T>(path: string, body: unknown): Promise<T> {
     body: JSON.stringify(body),
   });
   if (!res.ok) {
+    if (res.status === 401) throw new AuthRequiredError();
     let message = `HTTP ${res.status}`;
     try {
       const data = (await res.json()) as { error?: string };

lib/supabase/client.ts

@@ -0,0 +1,12 @@
+import { createBrowserClient } from "@supabase/ssr";
+
+let client: ReturnType<typeof createBrowserClient> | null = null;
+
+export function createClient() {
+  if (client) return client;
+  client = createBrowserClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,
+  );
+  return client;
+}

lib/supabase/config.ts

@@ -0,0 +1,3 @@
+export const AUTH_ENABLED =
+  !!process.env.NEXT_PUBLIC_SUPABASE_URL &&
+  !!process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY;

lib/supabase/guard.ts

@@ -0,0 +1,15 @@
+import { NextResponse } from "next/server";
+import { AUTH_ENABLED } from "./config";
+import { createClient } from "./server";
+
+export async function requireUser(): Promise<
+  { userId: string } | NextResponse
+> {
+  if (!AUTH_ENABLED) return { userId: "anonymous" };
+  const supabase = await createClient();
+  const claims = await supabase.auth.getClaims();
+  if (claims.error || !claims.data?.claims?.sub) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  return { userId: claims.data.claims.sub };
+}

lib/supabase/server.ts

@@ -0,0 +1,20 @@
+import { createServerClient } from "@supabase/ssr";
+import { cookies } from "next/headers";
+
+export async function createClient() {
+  const cookieStore = await cookies();
+  return createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,
+    {
+      cookies: {
+        getAll: () => cookieStore.getAll(),
+        setAll: (cookiesToSet) => {
+          for (const { name, value, options } of cookiesToSet) {
+            cookieStore.set(name, value, options);
+          }
+        },
+      },
+    },
+  );
+}