Supabase
Environment, schema, migrations, and RLS — manual apply.
Environment variables
NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY (server only). Never expose service role to the client.
Schema & migrations
Apply SQL files in order from supabase/migration-manifest.json. Run pnpm verify:migrations in CI.
RLS
Row Level Security must be verified in the Supabase dashboard. Status page shows READINESS ONLY until verified.