Network shell, authentication, and role-based gating (Phase 1)

Captured retroactively. This project shipped before the roadmap surface existed. The credit value is a post-hoc estimate per the methodology in Entry 017 and is subject to revision under G-038's calibration mechanism.

What shipped

• Next.js 14 App Router project scaffold under web/, with TypeScript strict mode and React 18.3.
• Tailwind theme tokens for the OLN palette (oln-bg, oln-surface, oln-ink, oln-ink-muted, oln-ink-soft, oln-accent, oln-accent-soft, oln-accent-ink, oln-ok, oln-ok-soft, oln-warn, oln-warn-soft, oln-internal, oln-internal-soft, oln-phased, oln-phased-soft, oln-block, oln-block-soft, oln-border) and the prose-oln typography preset.
• Supabase integration using @supabase/ssr v0.3 with the createServerClient pattern and a parallel browser client.
• Auth plumbing: sign-in / sign-up / sign-out routes, server-side session reads via cookies, and a UserMenu client component.
• profiles table with a role enum (public, steward, admin), RLS policies, and the migration 20260427000000_add_profiles_role.sql.
• requireRole(role) and hasRole(role) helpers in src/lib/auth/ used to gate every admin route and conditional render.
• NetworkHeader shell + base layout.tsx providing the calm, no-franchise-chrome top bar.

Why this matters

Everything above the shell — the Journal, the Register, the Roadmap, the reactions, the admin dashboard — runs on these primitives. Naming this as its own project is what lets every later project assume the auth and role primitives are present.