feat(phase-b): Supabase navigation store, snapshot service, auth wiring

navigationStore: rewritten off Neo4j db names — Supabase whiteboard_rooms table,
  setAuthInfo(token, userId) pattern, auto-creates default room per context on first use
snapshotService: rewritten to Supabase Storage REST (/storage/v1/object/authenticated/cc.users/…),
  setAccessToken() instance method, static methods take accessToken not dbName
AuthContext/NeoUserContext: auth injected into nav store, no Neo4j db names required
singlePlayerPage: loadNodeData no longer calls Neo4j; snapshot wired via accessToken
navigation types: NeoGraphNode updated for Supabase-backed tree structure
transcriptionStore/Service: getSession() removed, accessToken via AuthContext
LLMConfigModal: auth context wiring fixes
GraphNavigator/GraphSidebar: updated nav components

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

src/contexts/AuthContext.tsx

@@ -33,9 +33,11 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   const [user, setUser] = useState<CCUser | null>(null);
   const [user_role, setUserRole] = useState<string | null>(null);
   const [accessToken, setAccessToken] = useState<string | null>(null);
-  const [loading, setLoading] = useState(true); // true until INITIAL_SESSION fires
+  const [loading, setLoading] = useState(true);
   const [error, setError] = useState<Error | null>(null);
 
+  const apiBase = import.meta.env.VITE_API_BASE as string;
+
   const persistSession = useCallback((session: Session | null) => {
     if (session) {
       storageService.set(StorageKeys.SUPABASE_SESSION, session);
@@ -69,57 +71,82 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     return { user: resolvedUser, role: resolvedRole };
   }, []);
 
+  const triggerUserInit = useCallback((token: string) => {
+    fetch(`${apiBase}/user/init`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}` },
+    })
+      .then(r => r.json())
+      .then(data => logger.debug('auth-context', '✅ User init', data))
+      .catch(err => logger.warn('auth-context', '⚠️ User init failed', { err }));
+  }, [apiBase]);
+
   useEffect(() => {
-    // Canonical Supabase auth pattern: rely solely on onAuthStateChange.
-    // INITIAL_SESSION fires immediately with the current session state,
-    // eliminating the race condition between loadInitialSession + onAuthStateChange.
     const { data: { subscription } } = supabase.auth.onAuthStateChange(
       async (event, session) => {
         logger.debug('auth-context', '🔄 Auth state change', { event, hasSession: !!session });
 
-        switch (event) {
-          case 'INITIAL_SESSION':
-          case 'SIGNED_IN':
-          case 'TOKEN_REFRESHED': {
-            persistSession(session ?? null);
-            if (session?.user) {
-              try {
-                const { user: resolvedUser, role } = await buildUserFromSupabase(session.user);
-                setUser(resolvedUser);
-                setUserRole(role);
-                setAccessToken(session.access_token ?? null);
-              } catch (buildError) {
-                logger.error('auth-context', '❌ Failed to build user from session', { event, error: buildError });
-                setUser(null);
-                setUserRole(null);
-                setAccessToken(null);
-                setError(buildError instanceof Error ? buildError : new Error('Failed to load user'));
-              }
-            } else {
+        if (event === 'SIGNED_IN') {
+          persistSession(session ?? null);
+          if (session?.user) {
+            try {
+              const { user: resolvedUser, role } = await buildUserFromSupabase(session.user);
+              setUser(resolvedUser);
+              setUserRole(role);
+              setAccessToken(session.access_token ?? null);
+              triggerUserInit(session.access_token);
+            } catch (buildError) {
+              logger.error('auth-context', '❌ Failed to build user from session', { event, error: buildError });
               setUser(null);
               setUserRole(null);
               setAccessToken(null);
+              setError(buildError instanceof Error ? buildError : new Error('Failed to load user'));
             }
-            // Always clear loading after the first auth event resolves
-            setLoading(false);
-            break;
-          }
-          case 'SIGNED_OUT': {
-            persistSession(null);
+          } else {
             setUser(null);
             setUserRole(null);
             setAccessToken(null);
-            setLoading(false);
-            break;
           }
-          default:
-            break;
+          setLoading(false);
+          return;
+        }
+
+        if (event === 'INITIAL_SESSION' || event === 'TOKEN_REFRESHED') {
+          persistSession(session ?? null);
+          if (session?.user) {
+            try {
+              const { user: resolvedUser, role } = await buildUserFromSupabase(session.user);
+              setUser(resolvedUser);
+              setUserRole(role);
+              setAccessToken(session.access_token ?? null);
+            } catch (buildError) {
+              logger.error('auth-context', '❌ Failed to build user from session', { event, error: buildError });
+              setUser(null);
+              setUserRole(null);
+              setAccessToken(null);
+              setError(buildError instanceof Error ? buildError : new Error('Failed to load user'));
+            }
+          } else {
+            setUser(null);
+            setUserRole(null);
+            setAccessToken(null);
+          }
+          setLoading(false);
+          return;
+        }
+
+        if (event === 'SIGNED_OUT') {
+          persistSession(null);
+          setUser(null);
+          setUserRole(null);
+          setAccessToken(null);
+          setLoading(false);
         }
       }
     );
 
     return () => subscription.unsubscribe();
-  }, [buildUserFromSupabase, persistSession]);
+  }, [buildUserFromSupabase, persistSession, triggerUserInit]);
 
   const signIn = async (email: string, password: string) => {
     try {