Sign in through Supabase Auth, then prove tenant access through ControlLayer.

The web app exchanges credentials only on a server route, stores bounded HttpOnly session cookies, and lets the API resolve roles, permissions, and module access from database membership records.