feat: Implement Supabase authentication, account management UI, and entitlement services.

frontend/app/api/city/[name]/detail/route.ts

@@ -1,5 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
-import { buildBackendRequestHeaders } from "@/lib/backend-auth";
+import {
+  applyAuthResponseCookies,
+  buildBackendRequestHeaders,
+} from "@/lib/backend-auth";
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
 
@@ -8,10 +11,11 @@ export async function GET(
   context: { params: Promise<{ name: string }> },
 ) {
   if (!API_BASE) {
-    return NextResponse.json(
+    const response = NextResponse.json(
       { error: "POLYWEATHER_API_BASE_URL is not configured" },
       { status: 500 },
     );
+    return response;
   }
 
   const { name } = await context.params;
@@ -30,23 +34,27 @@ export async function GET(
   const url = `${API_BASE}/api/city/${encodeURIComponent(name)}/detail?${searchParams.toString()}`;
 
   try {
+    const auth = await buildBackendRequestHeaders(req);
     const res = await fetch(url, {
-      headers: buildBackendRequestHeaders(),
+      headers: auth.headers,
       cache: "no-store",
     });
     if (!res.ok) {
       const raw = await res.text();
-      return NextResponse.json(
+      const response = NextResponse.json(
         { error: `Backend returned ${res.status}`, detail: raw.slice(0, 300) },
         { status: 502 },
       );
+      return applyAuthResponseCookies(response, auth.response);
     }
     const data = await res.json();
-    return NextResponse.json(data);
+    const response = NextResponse.json(data);
+    return applyAuthResponseCookies(response, auth.response);
   } catch (error) {
-    return NextResponse.json(
+    const response = NextResponse.json(
       { error: "Failed to fetch city detail aggregate", detail: String(error) },
       { status: 500 },
     );
+    return response;
   }
 }

frontend/app/api/city/[name]/route.ts

@@ -1,5 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
-import { buildBackendRequestHeaders } from "@/lib/backend-auth";
+import {
+  applyAuthResponseCookies,
+  buildBackendRequestHeaders,
+} from "@/lib/backend-auth";
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
 
@@ -8,10 +11,11 @@ export async function GET(
   context: { params: Promise<{ name: string }> },
 ) {
   if (!API_BASE) {
-    return NextResponse.json(
+    const response = NextResponse.json(
       { error: "POLYWEATHER_API_BASE_URL is not configured" },
       { status: 500 },
     );
+    return response;
   }
 
   const { name } = await context.params;
@@ -19,23 +23,27 @@ export async function GET(
   const url = `${API_BASE}/api/city/${encodeURIComponent(name)}?force_refresh=${forceRefresh}`;
 
   try {
+    const auth = await buildBackendRequestHeaders(req);
     const res = await fetch(url, {
-      headers: buildBackendRequestHeaders(),
+      headers: auth.headers,
       cache: "no-store",
     });
     if (!res.ok) {
       const raw = await res.text();
-      return NextResponse.json(
+      const response = NextResponse.json(
         { error: `Backend returned ${res.status}`, detail: raw.slice(0, 300) },
         { status: 502 },
       );
+      return applyAuthResponseCookies(response, auth.response);
     }
     const data = await res.json();
-    return NextResponse.json(data);
+    const response = NextResponse.json(data);
+    return applyAuthResponseCookies(response, auth.response);
   } catch (error) {
-    return NextResponse.json(
+    const response = NextResponse.json(
       { error: "Failed to fetch city detail", detail: String(error) },
       { status: 500 },
     );
+    return response;
   }
 }

frontend/app/api/city/[name]/summary/route.ts

@@ -1,5 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
-import { buildBackendRequestHeaders } from "@/lib/backend-auth";
+import {
+  applyAuthResponseCookies,
+  buildBackendRequestHeaders,
+} from "@/lib/backend-auth";
 import { buildCachedJsonResponse } from "@/lib/http-cache";
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
@@ -9,10 +12,11 @@ export async function GET(
   context: { params: Promise<{ name: string }> },
 ) {
   if (!API_BASE) {
-    return NextResponse.json(
+    const response = NextResponse.json(
       { error: "POLYWEATHER_API_BASE_URL is not configured" },
       { status: 500 },
     );
+    return response;
   }
 
   const { name } = await context.params;
@@ -21,34 +25,39 @@ export async function GET(
   const url = `${API_BASE}/api/city/${encodeURIComponent(name)}/summary?force_refresh=${forceRefresh}`;
 
   try {
+    const auth = await buildBackendRequestHeaders(req);
     const res = await fetch(url, {
-      headers: buildBackendRequestHeaders(),
+      headers: auth.headers,
       cache: "no-store",
     });
     if (!res.ok) {
       const raw = await res.text();
-      return NextResponse.json(
+      const response = NextResponse.json(
         { error: `Backend returned ${res.status}`, detail: raw.slice(0, 300) },
         { status: 502 },
       );
+      return applyAuthResponseCookies(response, auth.response);
     }
     const data = await res.json();
     if (bypassCache) {
-      return NextResponse.json(data, {
+      const response = NextResponse.json(data, {
         headers: {
           "Cache-Control": "no-store",
         },
       });
+      return applyAuthResponseCookies(response, auth.response);
     }
-    return buildCachedJsonResponse(
+    const response = buildCachedJsonResponse(
       req,
       data,
       "public, max-age=0, s-maxage=20, stale-while-revalidate=60",
     );
+    return applyAuthResponseCookies(response, auth.response);
   } catch (error) {
-    return NextResponse.json(
+    const response = NextResponse.json(
       { error: "Failed to fetch city summary", detail: String(error) },
       { status: 500 },
     );
+    return response;
   }
 }