Sign in (visitor)

Uses Supabase Auth (not admin CRM OAuth). Redirect URL must include …/auth/callback under Authentication → URL configuration.