Secure Sign In
Authentication now runs against live Supabase sessions and company access rules.
All non-super-admin users must change their password on first login before entering the app.