Authentication

Supabase/Better Auth adapters implement replaceable authentication ports. Native HttpOnly sessions are preferred. Redirect sanitation removes credentials from callback URLs. Public exceptions are explicit and narrowly mounted before protected wildcard routes.