Stage 12A: Sign in to app v3 and save work to the account #1253

Goal

Stage 12A of the unified API migration. App v3 (the flagship shell) gets a standard sign-in flow using Auth0 social sign-on, and a signed-in user's saved work moves from browser localStorage to their account in the Public API.

Problem

• The app has no authentication.
• Every user is the hard-coded MOCK_USER_ID = 'anonymous', and every association hook has isLoggedIn = false.
• Saved policies, households, simulations, reports and v3 reforms exist only in localStorage, so they are lost across devices and browsers (see Result session persistence: results evaporate between browser sessions #1091).
• The v3 Next.js /api/{reforms,reports} routes trust a client-supplied user_id, use a Drizzle/Postgres database that was never provisioned, and fall back to localStorage.

Scope

• Sign-in, app v3 only (US and UK): an Auth0 provider (@auth0/auth0-react) mounted in the v3 workspace, a callback route, a sign-in button and user menu in the v3 top bar, and an account page with export and delete. There are two states, signed in and signed out. The legacy calculator stays browser-only.
• Public API storage for v3, signed in or not: the v3 reform and report stores use the Public API /v2/user-policies and /v2/user-reports routes, as the account when signed in and as this browser's unauthenticated user (a UUID kept in localStorage, sent as a header) when signed out. With accounts off, and outside the US and UK, v3 keeps its own localStorage keys; it never uses the legacy calculator's.
• Upgrade at sign-in: POST /v2/me/upgrade turns the browser's unauthenticated user into the account (or merges its work into an existing account), then the browser starts over with a new UUID.
• Configuration: BASE_URL set per environment.
• Removal: the never-provisioned Next.js Drizzle database path.
• Everything sits behind NEXT_PUBLIC_AUTH_ENABLED.

Acceptance

• With sign-in disabled, behaviour is unchanged.
• With sign-in enabled on staging:
  • social sign-in works, and the session survives reloads;
  • saved reforms and reports appear on a second device;
  • export and delete work.

Related

• Requires Stage 12A: Sign-in identity and v1-anchored user associations policyengine-api#3891.
• PRs: Stage 12A: Sign in to app v3 and save work to the account #1252, Stage 12A: Check Auth0 permissions on Simulation Entrypoint routes policyengine-sim-api#758