Platform swap: Auth0 + Heroku Postgres + S3 in place of Supabase and Cloudflare

mosha101 is migrating the rainylabs fork off Supabase and onto an existing Auth0 tenant, Heroku-managed Postgres, and S3. The notable decision is what stays unchanged: the entire route layer.

The strategy is a shim-first migration. Rather than rewriting the routes that assume Supabase semantics, mosha101 introduces a pg-backed adapter that mimics the Supabase client surface so existing call sites compile unchanged. Drizzle stays as the schema source of truth. The frontend gets the same treatment: @auth0/nextjs-auth0 v4 handles the real auth flow, but a parallel shim exposes the familiar supabase.auth.* shape, fed by new /auth/profile and /auth/access-token bridge endpoints. JWT verification runs server-side via JWKS, with an internal public.users table upserted on every request keyed on the Auth0 subject claim.

Infrastructure comes as a multi-stage Node 20 Dockerfile with LibreOffice installed for DOC/DOCX-to-PDF conversion, plus a heroku.yml for container deploys. The PR is explicit about what can't be automated: Heroku app and add-on provisioning, Auth0 API and SPA registration, and AI provider key seeding are listed as manual preconditions rather than included in the code change.

The PR targets rainylabs' own main, so this is internal deployment work rather than anything proposed upstream. The shim strategy is the load-bearing decision: it treats this as an infrastructure migration and avoids a parallel business-logic rewrite.