feat(frontend): runtime ConfigContext + provider-aware AuthContext

Frontend half of the auth-boundary work.  The browser bundle is now
tenant-portable: the same image ships everywhere and reads its
deployment-mode configuration from /config at startup.

  * contexts/ConfigContext.tsx  - fetches /config on mount, exposes
                                  useConfig() and getCachedAuthProvider()
                                  so module-level helpers can answer
                                  "what mode are we in" without holding
                                  a React context.  Persists to
                                  localStorage so a hot reload doesn't
                                  blank-flash the supabase login page on
                                  an entra deployment.

  * contexts/AuthContext.tsx    - now branches on the resolved provider
                                  (supabase / local / entra) and routes
                                  sign-out through the new GET
                                  /api/auth/logout server endpoint
                                  rather than constructing the Microsoft
                                  logout URL in the browser.

  * lib/supabase.ts             - lazy getSupabaseClient() factory.
                                  Throws a clear error in non-supabase
                                  deployments rather than constructing
                                  a client against placeholder env
                                  vars.  Same treatment for
                                  supabase-server.ts and lib/auth.ts -
                                  helpers gracefully return null /
                                  skip when env vars are absent
                                  instead of asserting on placeholders.

  * lib/auth-token.ts           - central browser token retrieval that
                                  picks the right source (supabase
                                  session / local-mode hash / entra
                                  hash) based on cached provider.
                                  bounceIfUnauthorized() shared by every
                                  data-fetch hook.

  * components/providers.tsx    - wraps app shell with ConfigProvider
                                  outside AuthProvider so auth bootstrap
                                  can read from runtime config.

  * Consumers migrated off the old `supabase` named export to the
    lazy factory: contexts/UserProfileContext, app/lib/mikeApi,
    app/components/{assistant,shared}/*, app/hooks/*,
    app/login + signup pages.  All routes auth their requests through
    auth-token's getBrowserAccessToken() so provider mode is invisible
    to the call sites.