Signup, login, logout + each user's private data via RLS. Magic link, profile with avatar, password reset. No backend — everything runs on Supabase Auth + an anonymous JS client. After this course, any "each user sees their own" app becomes a normal task rather than magic.