feat: Implement Supabase authentication, account management UI, and entitlement services.

frontend/app/api/cities/route.ts

@@ -1,5 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
-import { buildBackendRequestHeaders } from "@/lib/backend-auth";
+import {
+  applyAuthResponseCookies,
+  buildBackendRequestHeaders,
+} from "@/lib/backend-auth";
 import { buildCachedJsonResponse } from "@/lib/http-cache";
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
@@ -7,34 +10,39 @@ export const dynamic = "force-dynamic";
 
 export async function GET(req: NextRequest) {
   if (!API_BASE) {
-    return NextResponse.json(
+    const response = NextResponse.json(
       { error: "POLYWEATHER_API_BASE_URL is not configured" },
       { status: 500 },
     );
+    return response;
   }
 
   try {
+    const auth = await buildBackendRequestHeaders(req);
     const res = await fetch(`${API_BASE}/api/cities`, {
-      headers: buildBackendRequestHeaders(),
+      headers: auth.headers,
       cache: "no-store",
     });
     if (!res.ok) {
       const raw = await res.text();
-      return NextResponse.json(
+      const response = NextResponse.json(
         { error: `Backend returned ${res.status}`, detail: raw.slice(0, 300) },
         { status: 502 },
       );
+      return applyAuthResponseCookies(response, auth.response);
     }
     const data = await res.json();
-    return buildCachedJsonResponse(
+    const response = buildCachedJsonResponse(
       req,
       data,
       "public, max-age=0, s-maxage=300, stale-while-revalidate=1800",
     );
+    return applyAuthResponseCookies(response, auth.response);
   } catch (error) {
-    return NextResponse.json(
+    const response = NextResponse.json(
       { error: "Failed to fetch cities", detail: String(error) },
       { status: 500 },
     );
+    return response;
   }
 }