Tee-time management and no-show revenue recovery for daily-fee golf courses.
Email/password and Google sign-in via Supabase Auth, with session cookies read server-side.
Middleware gates every page and API route. Signed-out visitors land on the login screen.
A row per account, mirrored from auth.users on signup, with an is_admin flag.