Local development mode: Authentication uses mock sessions. In production, sign-in is handled by Supabase Auth with email/password and Google OAuth. Extension login is bridged through a secure code-exchange flow.