Authentication, roles and multi-tenancy

Projects use Supabase Auth with email + password and OAuth providers. Passwords are bcrypt-hashed by Supabase; Blanca's Builder never sees plaintext.

Roles are stored in a dedicated `user_roles` table and checked via a security-definer function. Storing roles on the profile row is a known privilege-escalation pattern and Blanca's Builder forbids it.

Multi-tenant projects use an `organizations` table plus an `organization_members` join table. RLS policies scope every row to the active organization.

Internal staff accounts are completely separated from customer accounts and never appear in business metrics.