[CosmonautJones]

Root cause

src/middleware.ts:16 calls updateSession() for /tools, /admin, /login. updateSession calls createServerClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, …) at src/lib/supabase/middleware.ts:8-10 (on main). When those vars are unset, @supabase/ssr throws Your project's URL and Key are required to create a Supabase client!, so the middleware fails and every auth route returns 500. Netlify Deploy Previews don't have the vars, which is why previews 500 and prod is fine.

Fix (minimal)

• src/lib/supabase/middleware.ts: if !hasSupabaseConfig(), treat the request as anonymous. /tools* and /admin* still redirect 307 → /login?redirectTo=…. Everything else (including /login) is NextResponse.next(). No Supabase client is created.
• src/app/(auth)/login/page.tsx: passes authAvailable={hasSupabaseConfig()} to LoginForm.
• src/components/auth/login-form.tsx: when authAvailable is false, shows the approved Portfolio Copy fallback in place of the GitHub button: Sign-in isn't available here / "This preview isn't connected to sign-in. Use the live site to sign in, or keep browsing the work." plus links Go to the live site (https://www.travisjohnjones.com/login) and See the work (/work).
• When the env vars are set, nothing changes.

Verification (next build && next start)

Route	main, env unset	this PR, env unset	this PR, placeholder env
/login	500	200 (fallback copy, no GitHub button)	200 (Continue with GitHub)
/tools	500	307 → /login?redirectTo=%2Ftools	307 → /login?redirectTo=%2Ftools
/admin	500	307 → /login?redirectTo=%2Fadmin	307 → /login?redirectTo=%2Fadmin
/admin/tools	—	307 → /login?redirectTo=%2Fadmin%2Ftools	307 → /login?redirectTo=%2Fadmin%2Ftools
/	200	200	200

Checks: eslint 0 errors (1 existing warning in an untouched file, use-game-engine.ts). vitest 105 files / 980 tests pass. next build passes with env both unset and set. tsc --noEmit shows the same 5 test-file errors as main (being fixed on a separate branch) and no new ones.

Tests added:

• src/lib/supabase/__tests__/middleware-missing-env.test.ts: with env unset, /login passes through and /tools, /admin, /admin/tools redirect to /login with redirectTo. createServerClient is never called.
• login-form.test.tsx: with authAvailable={false}, the fallback copy and links render, there's no GitHub button, and no client is created.

Note: this does not make sign-in work on previews

This PR only stops the 500s. To get real sign-in on previews:

1. Turn on NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY for Netlify's Deploy Previews context (Trav's Netlify account).
2. Add the deploy-preview URL pattern (e.g. https://deploy-preview-*--<site>.netlify.app/**) to the Supabase Auth redirect allowlist. Without it, GitHub sign-in can't complete the /auth/confirm redirect on previews.

Do not merge until Trav.