Clara chat — Slice 4 plumbing

Dev auth surface: the pasted JWT lives in sessionStorage only and is sent as Bearer to the runtime and PostgREST. Real auth wiring is a later slice.

runtime: same-origin proxy · PostgREST: https://bzecqklouchkmdmdxlln.supabase.co