Authentication
Supabase Auth is wired for email and Google OAuth provider setup.
Production notes
Single-tenant for EPP now, with organization_id on every core table for later packaging.
Set CRM_WEBHOOK_SECRET before connecting app-to-app webhooks.
Turn on Supabase Google OAuth in the provider dashboard.
Use service-role key only on the server for webhook receivers and CSV import administration.