Supabase RLS 4-Tier RBAC Starter with Role Onboard

. Create a free Supabase project (supabase.com) and copy your Project URL and anon key. 2. Run supabase/migrations/001_rbac_schema.sql in the Supabase SQL Editor. 3. Run supabase/migrations/002_auth_profile_trigger.sql next. 4. Copy lib/supabase/, modules/auth/, and types/database.ts into your Next.js (App Router) project. 5. Add @supabase/ssr and @supabase/supabase-js to package.json (npm install @supabase/ssr @supabase/supabase-js). 6. Create a .env file with NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY. 7. Mount SignUpForm, SignInForm, OnboardingWizard, and wrap protected pages with RouteGuard. 8. Sign up a test user → a profile row appears automatically in public.users. 9. Promote an admin: insert their auth user id into public.admins (INSERT INTO public.admins (user_id) VALUES ('...')).