Internal sign in

Use Supabase SSO to enter Hatchstacks Ops.

Local dev creates a founder-scoped session when Supabase is absent. Production uses the configured internal identity provider.