Uses Supabase Auth via REST with refresh & persistence.