Will Anderson
eea9ff8ff4
The /account "Loading..." spinner stayed on forever because the browser-side waitlist read went through the anon key and didn't reach the row. Replaced it with a POST /api/my-plan: the server verifies the user's access_token via Supabase /auth/v1/user, then reads the waitlist row with the service key. Bypasses RLS without exposing the service key to the browser. Stripped implementation comments from the served JS so the browser doesn't broadcast how internals are shaped. Build pipeline: declared the supabase_auth_user stub for both build-local.sh and Dockerfile.stage so the bootstrap-injected forward declarations match what's actually linked.