Auth, Brain Data Hub, and User Permissions shipped

Supabase SSR authentication is now live — the /admin and /nexis routes are protected by middleware that checks app_entitlements. Three team accounts (Dante, Youness, Carolina) are linked to existing Supabase Auth with entitlements seeded (Youness and Carolina toggled off pending manual enable). The Settings > User Permissions tab shows a per-app per-user toggle grid with one switch per cell and a role badge below each. Nexis has a new Data Hub tab showing all 43 registered brain adapters with status, last-run info, and manual trigger for the 5 active cron adapters. Five cron routes are live (/api/cron/brain/fred, edgar, alpaca-prices, marketaux, embed-backfill) and scheduled in vercel.json. The pgvector match_news and match_filings RPCs are deployed. brain_adapters (43 rows) and brain_watchlist (10 seed symbols) tables are live.