Sign in with Google, GitHub, or a magic link backed by Supabase Auth. Your console routes stay protected while the runtime endpoints remain public by API key.