Wireframe only: no real Supabase Auth calls.
(Placeholder) button row in hi-fi mockups.
In real build: http-only cookie + server-side auth.
Callback routes redirect into onboarding → studio upload.