Supabase Auth

Mobile-first sign in for admins, coaches, and parents.

Signup creates a Supabase Auth user and the database trigger creates a matching profile. Team access still requires membership records; signup alone does not grant private team or child access.

Access boundary

Auth proves identity only. Private team data requires `organization_memberships` or `team_memberships` rows.

Parents manage child access through guardian links. Children do not log in.

Admin and coach roles still need an approved membership before privileged actions should appear.