Auth — Real Accounts, Real Protection

Give the app working sign-up/sign-in, a current user, and database policies that actually protect data. This skill splices into the two seams database left: the TEMPORARY RLS baseline and the // TODO(auth skill): current user constant.

Scope check (Step 0 rule)

Read codehance.md first. This skill owns component 3 (Authentication):