Make production auth resilient to invalid frontend Supabase config

[shibinsp]

Problem

The Vercel production frontend bundle is shipping an invalid VITE_SUPABASE_URL, which breaks direct browser Supabase auth calls and causes repeated token refresh failures.

Expected

• Email/password login and signup should continue working through the backend auth API even when the frontend Supabase URL is wrong.
• Google sign-in should fail clearly instead of looping on a dead Supabase host.

Scope

• Move standard frontend auth flows to backend /api/v1/auth/* endpoints.
• Keep Supabase usage only for social sign-in.
• Surface a clear UI warning when Supabase social auth is misconfigured or unreachable.

Verification

• Frontend build passes locally.
• Deployed backend /api/v1/auth/login responds normally in production instead of the browser hitting the broken Supabase hostname directly.