Account setup: restore Apple OAuth and responsive provider-first layout

docs/branch-review-ledger.md

@@ -930,4 +930,5 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie
 | 2026-08-12 | codex/specifiers-results-polish-20260813 | 3e82cca69a72a66c1be87c5b9357336c3a95b7b0 | specifier result-card layout and interaction | No findings after resolving reduced-motion, dark-mode, and focus-ring review items | focused Chromium 1/1; lint pass; typecheck pass; RAG fixtures 36/36; full unit suite has 17 unrelated Windows/tooling baseline failures |
 | 2026-08-12 | codex/specifiers-results-polish-20260813 | bbdb8337c2784941664a88a0d35a96a8c96a2edb | specifier result-card layout and interaction | Current-main sync introduced no changes to reviewed Specifiers scope; no findings after resolved review items | focused Chromium 1/1; lint pass; typecheck pass; RAG fixtures 36/36; full unit suite has 17 unrelated Windows/tooling baseline failures |
 | 2026-08-12 | PR #1870 / claude/design-issues-triage-wnr7k9 | 6edfeceeb768b5714f98dad355361ad9148374b0 | review-and-fix | Merged current main; corrected #310's per-record fuzzy-trigger analysis and regression-test condition; preserved #311; removed the temporary self-mutating workflow; no additional P0-P2 findings in a distinct adversarial pass. | verify:pr-local -- --files docs/branch-review-ledger.md,docs/outstanding-issues.md; check:outstanding-issues; check:branch-review-ledger; exact-head hosted CI pending |
+| 2026-08-12 | codex/chat-account-setup-elevate-account-setup-elevate-20260813 | eddac9fe2b1b87f9c31f995675091c92b19b58a1 | account setup redesign and Apple OAuth wiring | READY: no findings; live Apple provider activation remains operator-gated | focused auth DOM 24/24; targeted Chromium 2/2; lint/typecheck/build/design contracts passed; RAG fixtures 36/36; full Vitest blocked by baseline Windows hook failures; PDF isolated 9/9 |
 | 2026-08-12 | claude/ui-smoke-flake-290 | e41ceaf9f885cf929b32b4d6e17c445b617cde1f | #290 ui-smoke flake reproduction attempt on current main; browser-preflight findings | #290 archived not-reproducible: 3x full ui-smoke chromium runs 97 passed/0 failed/0 flaky each (291 executions) plus isolated repeat-each=5 on the named reproducer 5 passed at ~1.1s vs the ~11.5s failure signature; recorded as evidence not proof (row measured 2/5 and 3/5 failure rates) and resolved by drift past base 9ab3b73a. New #312 records that check:playwright-browser-revision OK means no root FORCED not browsers present, and that npx playwright install chromium + --project=chromium is a cheap first option | verify:pr-local 10/10 green; check:outstanding-issues 114 open/196 archived; 3 full ui-smoke runs captured to file with real exit codes |

docs/disaster-recovery-runbook.md

@@ -113,8 +113,8 @@ it before you need it:
   re-set it (`alter database ... set ...`) on the restored project.
 - **Edge functions** — deploy `indexing-v3-agent` (and the ingestion worker
   function) separately via the CLI.
-- **Dashboard config** — auth providers (magic link, Google/Microsoft SSO
-  redirect URLs), connection-pool caps (the documented 10-connection auth cap
+- **Dashboard config** — auth providers (magic link, Apple/Google/Microsoft SSO
+  redirect URLs and the rotating Apple web OAuth secret), connection-pool caps (the documented 10-connection auth cap
   is dashboard-only), API keys (publishable + service role are per-project;
   every consumer needs the new values), `E2E_USER_*` test accounts.
 - **Role settings** — e.g. `alter role authenticator set

docs/multi-user-auth-setup.md

@@ -1,7 +1,7 @@
 # Multi-user auth — Supabase configuration checklist (you apply)
 
 The app ships multi-user auth code (persistent cookie sessions, email OTP /
-magic link + Google/Microsoft OAuth, per-user isolation). Password helpers
+magic link + Apple/Google/Microsoft OAuth, per-user isolation). Password helpers
 exist in `src/lib/supabase/client.tsx`, but the shipped sign-in UI
 (`auth-panel.tsx`) exposes magic link + OAuth only — do not treat password
 signup as a required operator verification path until a password form ships.
@@ -21,6 +21,15 @@ commits. Target project: `Clinical KB Database` <!-- pragma: allowlist secret --
   signups). Enable **Email OTP** (magic link — the shipped UI path). Enabling
   **Password** in Supabase is optional until a password form is exposed in the
   app UI.
+- **Apple**: create an Apple App ID with **Sign in with Apple**, then a Services
+  ID for the web app. Register the production domain and use the Supabase
+  callback `https://sjrfecxgysukkwxsowpy.supabase.co/auth/v1/callback` as the
+  return URL. Generate the Apple client secret from the signing key (`.p8`),
+  configure the Services ID as the first Client ID in Supabase, and enable the
+  provider. Keep the signing key outside the repo and any client-accessible
+  configuration. Apple web OAuth secrets expire every six months, so record an
+  operator-owned rotation reminder and rotate before expiry. See the
+  [Supabase Apple provider guide](https://supabase.com/docs/guides/auth/social-login/auth-apple).
 - **Google**: create an OAuth client in Google Cloud Console → add the Supabase
   callback `https://sjrfecxgysukkwxsowpy.supabase.co/auth/v1/callback` as an
   authorized redirect URI → paste client ID/secret into Supabase → enable.
@@ -69,8 +78,9 @@ the Supabase dashboard → Project Settings → API:
 - `SUPABASE_SERVICE_ROLE_KEY` (server-only; never exposed to the client — copy
   from the dashboard; do not commit real values to docs or Git)
 
-The **Supabase OAuth callback** to authorize in the Google Cloud / Azure AD app
-registrations (§1) is `https://sjrfecxgysukkwxsowpy.supabase.co/auth/v1/callback`.
+The **Supabase OAuth callback** to authorize in the Apple, Google Cloud, and
+Azure AD app registrations (§1) is
+`https://sjrfecxgysukkwxsowpy.supabase.co/auth/v1/callback`.
 OAuth client secrets live in **Supabase**, not in app env.
 
 ## 7. Database RLS + storage — already in place (verified against live 2026-07-03)
@@ -109,7 +119,8 @@ to launch):**
 ## Verification (staging, after the above)
 
 1. **Magic link** → email OTP / link → signed in.
-2. **Google** and **Microsoft** SSO → signed in.
+2. **Apple**, **Google**, and **Microsoft** SSO → signed in through the shared
+   `/auth/callback` PKCE exchange.
 3. **Hard-refresh** the page → still signed in (persistent cookie session).
 4. **Isolation and shared content:** sign in as user A, upload a document and
    create a private registry override, then sign out; sign in as user B → B sees

src/app/auth/callback/route.ts

@@ -6,7 +6,7 @@ import { createSupabaseServerClient } from "@/lib/supabase/server";
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
-// Handles the PKCE code return for OAuth (Google/Microsoft), email-confirmation,
+// Handles the PKCE code return for OAuth (Apple/Google/Microsoft), email-confirmation,
 // and magic-link sign-in. Exchanges `?code=` for a session, writing the session
 // cookies via the cookie-aware server client, then redirects into the app.
 export async function GET(request: Request) {