Remove sign-in screen; serve every request as a default user

[rogerdemello]

Fixes the "API failed" errors on the live site.

What changed

No more login. src/pages/Auth.tsx and src/components/ProtectedRoute.tsx are deleted. "Get Started" goes straight to /dashboard; /login, /signup and /auth redirect there so old links do not 404. The sidebar "Sign out" button and the redirect-to-login effect in ClientLayout are gone.

requireAuth resolves a default user. Every data route sat behind requireAuth, so with no login there was no token and /api/proposals, /api/rules, /api/analytics/summary and /api/audit all returned 401. The middleware now falls back to a default user picked by DEMO_USER_EMAIL, else the first ADMIN, else the first row in User. A valid token still wins; an expired or malformed one falls back instead of 401-ing.

Also:

• GET /api/auth/session tells the SPA which user it is acting as. authLimiter moved from the whole /api/auth mount onto just the credential routes, so this per-page-load lookup is not rate-limited to 10/15min.
• An unresolvable session returns 503 with the real DB error and the env vars to check, instead of a generic 500.
• Dropped the hardcoded Supabase project ref that src/lib/supabase.ts used as a fallback for SUPABASE_URL. A stale ref turned every query into an opaque DNS failure instead of naming the missing config.
• OAuth Connect buttons no longer require a localStorage token that can no longer exist.
• DEMO_USER_EMAIL documented in .env.example and render.yaml, pointed at admin@reviewer.ai (the actual seeded admin).

Verification

tsc --noEmit clean, eslint 0 errors, vite build succeeds, 51/51 tests pass. The auth/notifications tests that asserted the old 401 behavior were rewritten, with new cases for an empty User table and an unreachable DB.

Smoke-tested against the local server with the restored database:

/api/auth/session       200  {"user":{"email":"admin@reviewer.ai","role":"ADMIN"}}
/api/proposals          200  [{"title":"Website Update Proposal", ...}]
/api/rules              200  [{"name":"Max payment days", ...}]
/api/analytics/summary  200  {"totals":{"total":1,"pending":1, ...}}
/api/audit              200  [{"action":"Created proposal", ...}]
/api/templates          200  []
/api/integrations       200  [{"type":"HUBSPOT", ...}]

Before merging

autoDeploy is on, so merging deploys. Set SUPABASE_URL, SUPABASE_ANON_KEY and DATABASE_URL in the Render dashboard to the restored project first, or the live site will 503 on session lookup.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.