Auth redirect handler for Supabase magic links and callbacks #186

🧾 Title

Auth redirect handler for Supabase magic links and callbacks

🧠 Summary

Supabase appends session tokens as URL hash fragments on redirect for email confirmation, magic link sign-in, and password reset flows. Without a handler these fragments are silently ignored and the user is shown the app unauthenticated.

📦 Scope

Detect and consume the #access_token, #refresh_token, and #type hash params that Supabase appends on redirect, exchange them for a valid session, then redirect to the appropriate post-auth screen.

🚫 Out of Scope

OAuth provider callbacks (those go through Supabase's built-in PKCE flow and land differently).

✅ Acceptance Criteria

• Email confirmation links land the user in an authenticated session
• Magic link sign-in links land the user in an authenticated session
• Password reset links land on the password reset form (not the hub)
• Stale or invalid hash tokens show a clear error rather than a silent no-op

🧪 Testing / Validation

• Send a confirmation email, follow the link, verify authenticated
• Send a magic link, follow it, verify authenticated
• Request a password reset, follow the link, verify the reset form appears