clapointe-carbonleo bolts a real front door onto Mike - but leaves the inner rooms unlocked

This fork is a CarbonLeo deployment, and clapointe-carbonleo just took it through a full authentication rebuild in three quick moves. It started rough: a bring-up shortcut that tore out roughly a thousand lines of access-control code and treated every user as the same "internal" account. From there the team added a proper sign-in screen - French-language, CarbonLeo-branded - backed by Supabase, a hosted service that handles email-and-password login and session tokens. The backend now genuinely checks that token before letting anyone through.

The catch worth flagging: the front door is real, but the room-by-room locks aren't. Once you're authenticated, the per-document and per-project ownership and sharing checks still wave everyone through. So the system knows who you are, but not yet what you're allowed to touch.