Fix auth end-to-end and add Cloudflare verification handoff

[SaharPak]

Summary

Consolidates the auth work and adds a Cloudflare-focused deployment handoff. The auth code itself (cookie-preserving proxy redirects, onboarding upsert, callback error logging) was already on fix/auth and is verified to work; this PR brings that work forward as a focused branch and replaces Vercel assumptions in the docs.

Auth fixes (verified)

• src/lib/supabase/middleware.ts — added redirectWithCookies helper. Both redirect sites (protected-route denial, onboarding gate) forward any refreshed auth cookies so the session survives proxy-driven redirects. Without this, an expired-session refresh inside getUser() was silently discarded on the next redirect, causing the classic "log in then loop back to /login" symptom.
• src/app/onboarding/actions.ts — switched update → upsert({...}, { onConflict: "id" }). If the handle_new_user trigger never created a profile row in the live DB, the previous update matched zero rows silently and the user was stuck on /onboarding forever.
• src/app/auth/callback/route.ts — consolidated error logging to a single console.error that records only error.message and error.status (no tokens, codes, cookies, or env values). Removed redundant fallback path.

Validation on this branch:

• npm run lint — pass
• npm run build — pass (14 routes built)
• scripts/auth-smoke.sh — 16/16 pass

Cloudflare correction

Vercel assumptions were removed because deployment target is Cloudflare. Updated:

• README.md — Deployment section now describes Cloudflare Pages + OpenNext, not Vercel.
• OPERATIONS.md — Cron is now a Cloudflare Cron Trigger (wrangler.toml); vercel.json is documented as legacy.
• DEVELOPER_HANDOFF_PRODUCT_BUILDERS.md — replaced Vercel references with Cloudflare.
• docs/AUTH_DEBUGGING_HANDOFF.md — added sections G–K for Supabase URL Configuration, Google Cloud Console, Cloudflare Pages project, Cloudflare env vars (public vs secret), and local .dev.vars.

vercel.json is intentionally left in place — it is inert on Cloudflare (Cloudflare ignores it) and acts as a historical reference for the cron schedule. Remove it once the Cloudflare Cron Trigger is verified to fire.

A wrangler.toml template is included in OPERATIONS.md ("Cloudflare setup" section) but not yet committed to the repo. The Owner must add it with their Cloudflare account ID / project name — those values cannot be invented. The @opennextjs/cloudflare adapter was not installed on this branch because it is a deployment-environment addition, not an auth fix.

Manual owner checklist (must do, cannot be automated)

1. Create Cloudflare Pages project, install @opennextjs/cloudflare, add wrangler.toml from OPERATIONS.md.
2. Set the four env vars in Cloudflare (two public at build time, two secret). See docs/AUTH_DEBUGGING_HANDOFF.md § J.
3. Supabase Auth → URL Configuration: add http://localhost:3000 (dev) and the Cloudflare production domain (with /auth/callback in Additional Redirect URLs).
4. Supabase Auth → Providers → Google: enable, paste Client ID/Secret from Google Cloud Console.
5. Google Cloud Console → OAuth client: add Cloudflare domain(s) to Authorized JavaScript origins, keep https://<ref>.supabase.co/auth/v1/callback as Authorized redirect URI.
6. Google Cloud Console → Consent screen: add test account if status is "Testing".
7. Run migrations 001–003 in Supabase SQL editor (idempotent).
8. Create public Storage bucket product-images.

What was not done (and why)

• db push / db reset against production — destructive, owner-only.
• service-role key use beyond cron handler — already used in src/app/api/cron/demo-day/route.ts; no new uses were added.
• real Google OAuth browser test — owner has the test Google account. Smoke script exercises every code path that doesn't require a real user session.
• real magic-link inbox test — magic-link rate limit was hit in earlier sessions; only the owner can click a fresh link.
• Playwright suite — out of scope for this branch; recommended as the next task.
• wrangler.toml committed to repo — needs the owner's account ID; template is in OPERATIONS.md.

Safety notes

• No .env / .env.local / secrets were committed. Branch diff excludes them.
• No destructive database operations were run. No migrations were applied to the production project.
• The supabase/migrations files were read but not modified.
• The git push and this PR were performed under the owner's own GitHub credentials via the locally authenticated gh CLI.

[SaharPak]

Follow-up hardening (this push)

Two changes added since the initial review of this PR:

1. scripts/auth-smoke.sh is now BASE_URL-safe

The previous version stripped localhost:3000 from the Location header, which silently broke against production and Cloudflare preview URLs.

• New normalize_location() turns absolute or relative Location headers into just path+query.
• Unit-tested against 10 inputs: relative, absolute localhost, absolute production (https://productbuilders.app), Cloudflare Pages preview (https://fix-auth-end-to-end-product.<project>.pages.dev), empty, bare host, trailing-slash host, query, fragment, uppercase scheme.
• All assertions now check the normalized path+query, not the host-prefixed raw value.

Works against http://localhost:3000, https://productbuilders.app, and any <branch>.<project>.pages.dev Cloudflare preview URL.

2. src/app/auth/callback/route.ts no longer trusts x-forwarded-host

The previous production branch read x-forwarded-host to build the post-login redirect host. That header is spoofable: an attacker can set x-forwarded-host: evil.com on a forged request and have the callback redirect a freshly-authenticated user to https://evil.com/....

Added getSafeRedirectOrigin(request) with strict priority:

1. NEXT_PUBLIC_SITE_URL — owner-configured, validated as http(s): URL.
2. Request origin in development.
3. Request origin in production (sane fallback; on Cloudflare Pages the request URL is the external URL the browser sent).

x-forwarded-host is never consulted. If NEXT_PUBLIC_SITE_URL is unset in production, the callback logs a one-shot warning and falls back to the request origin.

New env var: NEXT_PUBLIC_SITE_URL

Documented in .env.example, README.md, and docs/AUTH_DEBUGGING_HANDOFF.md. Required in production. Optional in dev (request origin is used).

Validation (latest commit ceb0bcb)

Command	Result
npm run lint	pass
npm run build	pass — 14 routes
scripts/auth-smoke.sh (default)	16 passed, 0 failed
BASE_URL=http://localhost:3000 ./scripts/auth-smoke.sh	16 passed, 0 failed
normalize_location() unit tests	10 passed
Direct callback probes (/auth/callback with no code / empty code / provider error)	All redirect to /login?error=... as expected

Remaining owner actions (unchanged from before)

All previous Supabase / Google / Cloudflare dashboard checks still apply. In addition:

• Set NEXT_PUBLIC_SITE_URL per environment in Cloudflare Pages (e.g. https://productbuilders.app for Production, the pages.dev preview URL for Preview).

No destructive operations. No secrets committed. No force-push.