feat(sprint-4/etapa-1): Supabase auth + Google OAuth + LoginPage + rutas protegidas

- Cliente Supabase singleton en src/lib/supabase.ts
- Interfaces AuthUser / AuthService en src/auth/types.ts
- SupabaseAuthService: signInWithGoogle, signOut, getCurrentUser, onAuthStateChange
  con upsert a tabla users (platform_admin para @inquality.com.py, guest resto)
- AuthProvider (React Context) wrappea toda la app; expone user, loading, signIn, signOut
- LoginPage /login: logo InQuality color, título, fade-in, botón Google naranja #F59845
- RootComponent del router guarda todas las rutas — sin sesión → /login, con sesión + /login → /
- Script SQL: supabase/migrations/001_create_users.sql (tabla users + RLS)
- AppHeader: <Link> → <a href="/"> para evitar dependencia de RouterContext en tests
- 561/561 tests verdes, build sin errores TS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

supabase/migrations/001_create_users.sql

@@ -0,0 +1,21 @@
+-- Tabla users: extiende auth.users con atributos de la plataforma
+CREATE TABLE IF NOT EXISTS public.users (
+  id            uuid PRIMARY KEY REFERENCES auth.users(id) ON DELETE CASCADE,
+  name          text,
+  avatar_url    text,
+  platform_role text NOT NULL DEFAULT 'guest'
+                CHECK (platform_role IN ('platform_admin', 'member', 'guest')),
+  created_at    timestamptz NOT NULL DEFAULT now()
+);
+
+-- RLS
+ALTER TABLE public.users ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "read_users" ON public.users
+  FOR SELECT USING (auth.uid() IS NOT NULL);
+
+CREATE POLICY "update_own_user" ON public.users
+  FOR UPDATE USING (id = auth.uid());
+
+CREATE POLICY "insert_users" ON public.users
+  FOR INSERT WITH CHECK (id = auth.uid());