🔴 Security & auth hardening for production

Context

Dev-only auth bypass + demo accounts exist for local review and must be resolved before real users.

Tasks

• Separate prod database — mock seed + demo accounts must not live in the prod DB (currently shared Supabase). Provision a clean prod DB.
• Delete/rotate demo accounts — admin@demo.test, creator@demo.test, orgadmin@demo.test use the known password DemoPass123!; a known-password platform admin cannot exist in prod.
• Bypass gating — confirm DEV_DISABLE_AUTH is never set in prod env and NODE_ENV=production; consider stripping the src/proxy.ts / src/lib/auth/session.ts bypass from the prod build.
• Secrets — real BETTER_AUTH_SECRET; rotate anything seen in a dev .env; secrets only in the prod host, never committed.
• Auth hardening — rate-limiting / brute-force protection; enforce email verification (on); finish 2FA rollout; cookie/session security; CSP + security headers.
• RBAC audit — verify requireUser / requireTenantMember / requirePlatformAdmin gates on all 5 surfaces; no IDOR on tenant/credential/order lookups.
• Security review — pnpm audit, secret scanning, run a full security-review pass.

Acceptance

No dev-only auth path reachable in prod; no known-password accounts; secrets rotated; security review clean.

Start with src/proxy.ts and src/lib/auth/session.ts, then trace the requireUser, requireTenantMember, and requirePlatformAdmin gates across the five surfaces named in the issue. Inspect the production environment and Supabase setup, run pnpm audit and the repository's security checks, and use the acceptance criteria to verify that no development auth path or known-password account remains.