Supabase auth hardening checklist that keeps production sign-in safe

Production sign-in breaks in predictable places: an open redirect, an email link that lands on the wrong URL, a table that exposes rows to the wrong user, or a privileged key that shipped inside a cli