e2e-1: hosted account spine — Google sign-in + account-scoped read path

[ReliOptic]

Track

First-real-user E2E: web sign-in → CLI login → host agent registers → Cronlet visible/approvable in UI.

Purpose

Today the web app is a static SPA with no auth and no backend (app/src/main.tsx picks SeededDemoApi or EmptyApi; vercel.json is static). The CLI is 100% local (~/.mycron/store.json, zero network calls). Nothing an agent registers can ever appear in the hosted UI. This PR creates the spine everything else attaches to: Supabase Auth (Google) + an account-scoped READ path.

Scope

• app/src/backend/supabase.ts client from VITE_SUPABASE_URL/ANON_KEY (env-driven; absent env → app behaves exactly as today)
• Google OAuth sign-in/out; AccountSurface shows identity + sign-out
• supabase/migrations/0001_init.sql: accounts, cronlets (unique (account_id, client_ref)), RLS owner-only SELECT, no insert/update policies (mutations come via server API later)
• SupabaseApi implements MyCronApi reads only; all writes throw NotImplementedError
• resolveApi: demo flag → SeededDemoApi; session+env → SupabaseApi; else EmptyApi

Non-scope

Mutation endpoints, CLI changes, approval/audit endpoints, device auth, seeding.

Acceptance

• Sign in with Google → empty dashboard scoped to my account; sign out → today's behavior
• npm run typecheck && npm test && npm run build pass with and without Supabase env
• No mock data added to src/; src/ contract unchanged

[ReliOptic]

Part of the first-real-user E2E epic: #76 (sequence + dependency graph + demo definition there).

[ReliOptic]

Supabase CLI automation checkpoint

Tried to replace the manual prerequisite with Supabase CLI from the MyCron checkout.

What was verified:

• Supabase CLI is installed and authenticated (supabase 2.101.0).
• Vercel project is linked locally as mycron (.vercel/project.json).
• Supabase orgs are visible, including the Vercel-linked org ckiwon7-6820's projects.
• Existing projects list does not show a mycron project.
• PR e2e-1: hosted account spine #74 remains clean/mergeable with Vercel preview checks passing.

Attempted default:

• project name: mycron
• org: ckiwon7-6820's projects
• region: ap-northeast-2
• generated DB password held only in shell memory, not committed or printed

Result:

• --size nano was rejected by the installed CLI validator.
• --size micro was rejected because free-plan orgs cannot specify instance size.
• Creating without --size was rejected by Supabase account/org limits:

The following organization members have reached their maximum limits for the number of active free projects within organizations where they are an administrator or owner: ReliOptic (2 project limit). To continue, these users will need to either delete, pause or upgrade one or more of these projects.

No MyCron Supabase project was created, linked, migrated, or added to Vercel env.

Decision now required before #67 can be live-verified:

1. pause/delete an existing active free Supabase project,
2. upgrade/create paid capacity, or
3. explicitly reuse an existing project/ref for MyCron.

Google OAuth remains a separate credential prerequisite: Supabase docs require a Google Cloud OAuth Client ID/Secret before the Google provider can be enabled.

[ReliOptic]

cronbell reuse applied for #67.

• Supabase target: cronbell / ybvgltbfrllxenvfkynr / ap-northeast-2 / ACTIVE_HEALTHY.
• Remote DB was not pristine: it already had an older public.cronlets table and a remote migration history entry outside this repo.
• To avoid destructive reset/drop, PR e2e-1: hosted account spine #74 now makes the MyCron read-spine migration additive/idempotent and keeps legacy rows intact.
• Applied the read-spine SQL to cronbell via supabase db query --linked because supabase db push --linked is blocked by the pre-existing remote migration version 20260607125000.
• Verified remote shape: public.accounts exists; public.cronlets has MyCron columns (account_id, client_ref, requires_approval, external_execution_approved, next_run, spec, etc.); owner-select policies exist.
• Vercel env added for VITE_SUPABASE_URL + VITE_SUPABASE_ANON_KEY: production, development, and preview branch feat/e2e1-hosted-account-spine.
• New preview deployment for commit b47941f: https://mycron-g3jy02tgf-ckiwon7-6820s-projects.vercel.app
• Smoke: GET /account returned 200 and bundled env contains the cronbell Supabase URL/key marker.

Code validation on b47941f:

npm run typecheck && npm test && npm run build && git diff --check
# passed: app 5 files / 19 tests, CLI 11 files / 60 tests, build passed

Still external/manual: Google OAuth provider client + redirect configuration in Supabase remains unverified here.

[ReliOptic]

Supabase reused project display name updated to reduce confusion.

• Before: cronbell
• After: mycron
• Project ref unchanged: ybvgltbfrllxenvfkynr
• Region/status unchanged: ap-northeast-2 / ACTIVE_HEALTHY
• Supabase URL/env remain unchanged: https://ybvgltbfrllxenvfkynr.supabase.co

Verification:

PATCH /v1/projects/ybvgltbfrllxenvfkynr {"name":"mycron"} -> mycron / ybvgltbfrllxenvfkynr
supabase projects list -> mycron / ybvgltbfrllxenvfkynr / ACTIVE_HEALTHY / ap-northeast-2

[ReliOptic]

Update: cronbell reuse has been reverted after discovering Campsite depends on that Supabase project.

What changed:

• Supabase project ybvgltbfrllxenvfkynr display name restored to cronbell.
• MyCron Vercel env vars VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY were removed from Production, Development, and Preview so the hosted MyCron app no longer points at Campsite/cronbell storage.
• The inactive separate project dobzpikndbmnmugivnxf was renamed to mycron as the reserved MyCron-owned Supabase target.

Blocked:

• Creating or activating a separate MyCron Supabase project is currently blocked by Supabase's free active-project limit: this account already has 2 active free projects (cronbell and FEVIO).
• dobzpikndbmnmugivnxf is still paused/inactive; supabase link --project-ref dobzpikndbmnmugivnxf reports project is paused.

No Campsite/cronbell data was dropped. Any cleanup of the additive MyCron columns previously applied to cronbell should be handled as a separate explicit cleanup step after Campsite impact review.