Add Secure AI Streaming to React Native + Expo

Never call an AI provider directly from a mobile client. Put the provider key in server-side secret storage and require a verified user identity, bounded input, and a server-side quota before every provider request.

Required controls

• Use an authenticated backend route. For Supabase Edge Functions, use withSupabase({ auth: 'user' }) and keep verify_jwt enabled for user-facing functions.
• Do not accept a merely present Authorization header as proof of identity.
• Keep provider keys in server-side secret storage only. Never use an EXPO_PUBLIC_ variable for a private provider key.
• Enforce a per-user, server-side rate and spend quota with an atomic datastore operation before calling the provider.
• Bound message count, message size, allowed roles, and request frequency.
• Show a provider-specific disclosure and obtain consent before the first transfer of user content.

Authenticated Supabase Edge Function

The following pattern uses Supabase's authenticated user mode. It intentionally keeps the quota implementation server-side because its schema and atomic operation depend on the application's datastore.

import { withSupabase } from 'npm:@supabase/server';