Supabase Auth in Expo: Sessions, OAuth, and Protected Routes That Hold Up in Production

The parts of Expo + Supabase auth that break after launch — unencrypted sessions, token refresh on resume, OAuth redirects, and RLS.