feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.superpowers/sdd/progress.md

@@ -164,3 +164,21 @@ Base commit: 3a5daaa
 - [x] Task 3: Create reset-password page + login success banner (commit fa88d62, review clean)
 - [x] Task 4: Deploy to VPS (commit fa88d62 + 4fbab33, deployed)
 - [x] Final review fixes: middleware isPublicRoute, Link basePath, session guard (commit 4fbab33, re-review approved)
+
+# CAPA Owner Notes SDD Progress Ledger
+
+Plan: docs/superpowers/plans/2026-07-23-capa-owner-notes.md
+Started: 2026-07-23
+Base commit: 71cf90e
+
+## Tasks
+
+- [x] Task 1: DB migration — owner_notes column (commit 52171ac, review clean — Critical finding resolved: column confirmed live via admin client SELECT)
+- [x] Task 2: API expose owner_notes (commit 96eaeb7, review clean)
+- [x] Task 3: CapaOwnerNotesForm component (commit 5f34dbb, review clean)
+- [x] Task 4: Wire pages + deploy (commit 938eb7e, review clean)
+- [x] Task 4: Wire pages + deploy (commit 938eb7e, review clean)
+- [x] Final review fixes: field-level auth split, status gate, RLS migration, audit old_value, pending_verification form guard (commit 509ed90, re-review approved)
+
+## Status: COMPLETE (deployed)
+One manual step outstanding: apply supabase/migrations/20260723000002_tighten_capa_update_rls.sql via Supabase dashboard SQL editor.