Sign-in and accounts

Moss uses Supabase Auth only to prove who someone is; Moss itself decides what they may do. Sign-in works out of the box: releases include the public sign-in settings in .env. Open the panel, create an account or sign in with a provider, and enter the one-time setup token Moss wrote to <data dir>/setup-token to become the owner. Anyone else needs an invite from the owner, even though the sign-in service itself is open.

• Roles: owner, admin, user, plus per-server grants (manager, operator, viewer).
• Pin the owner by e-mail with MOSS_OWNER_EMAILS, require two-factor sign-in with MOSS_REQUIRE_MFA, and create personal API tokens in Settings.
• Locked out? docs/recovery.md explains moss recover.
• To use your own Supabase project, set SUPABASE_URL and SUPABASE_ANON_KEY in .env.local (secrets and MOSS_OWNER_EMAILS belong there, never in .env).