Add Clerk authentication

[jluk]

Goal

Gate access so app can go public. Replace TEMP_USER_ID with real user IDs.

Requirements

• Clerk integration with Next.js middleware
• Re-enable Supabase RLS policies (already written for JWT claims)
• Migrate localStorage settings to user profile in DB
• Sign-in/sign-up flow

Blocked by

Nothing — can start anytime. Issue #2 was the original tracker, closing that in favor of this updated version.