Fix auth signup profile and token handling

[cursor]

Bug and impact

• New Supabase signups received valid auth tokens but no application users row was created, so subsequent user-scoped features could fail with missing profiles or foreign-key errors.
• The frontend expected auth responses under data.session.*, while the backend returns data.tokens.*, causing login/signup success handlers to crash before storing tokens or navigating.

Root cause

• Backend auth only created the Supabase user and returned a minimal user object.
• Frontend auth types/hooks were out of sync with the backend response contract.

Fix

• Upsert the application user row during signup, and also ensure it exists on login/refresh for recovery of already-created auth users.
• Roll back the Supabase user if application user creation fails during signup.
• Align frontend auth response types and hooks with the backend tokens response.
• Add focused backend and frontend regression tests.

Validation

• pnpm --filter @snacktrack/shared-types build
• DATABASE_URL=postgresql://localhost:5432/snacktrack_test DIRECT_URL=postgresql://localhost:5432/snacktrack_test pnpm --filter @snacktrack/backend db:generate
• pnpm --filter @snacktrack/backend test -- auth.test.ts
• pnpm --filter @snacktrack/frontend test -- use-auth.test.tsx
• DATABASE_URL=postgresql://localhost:5432/snacktrack_test DIRECT_URL=postgresql://localhost:5432/snacktrack_test pnpm --filter @snacktrack/backend build
• pnpm --filter @snacktrack/frontend build