API + Supabase Route Conventions

Shared handler recipe for both apps. Project overlays may add namespaces, CORS details, or stricter “no Server Actions” rules.

Handler flow

1. Auth — reject unsigned users with 401
2. Parse body — JSON → 400 on failure
3. Validate — Zod safeParse() → 422 on failure
4. Query — Supabase scoped by owner (user_id / profile id)
5. Respond — entity-named JSON or standard error body