Implement Supabase-to-Nakama login polish and auth state UI

[JOY]

Summary

Polish the current Supabase anonymous login and Nakama custom auth bridge so auth state is clear during Play Mode and future playtests.

Scope

• Show auth state, Supabase user id, Nakama session state, and fallback mode in debug UI.
• Keep local device fallback explicit and visually marked.
• Add retry and error messaging for disabled anonymous auth, expired token, or Nakama rejection.
• Document required Supabase settings for local Play Mode.

Acceptance Criteria

• Play Mode clearly shows whether auth is Supabase-backed or local fallback.
• Supabase anonymous login failures produce actionable debug status.
• Nakama custom auth rejection does not silently fall back unless fallback is explicitly enabled.
• Backend or integration tests cover accepted and rejected token paths where possible.

References

• docs/ARCHITECTURE.md
• ROADMAP.md

[JOY]

Implementation progress in dev:

• Unity HUD now displays auth source, Supabase user id, Nakama user id/session state, resolved Nakama URL, fallback lock state, and the latest actionable auth issue.
• Device auth fallback is no longer silently enabled just because Nakama is local. It must be enabled through SecondSpawnGatewayClient or -secondspawn-allow-device-auth.
• Local multi-client launcher now passes explicit device fallback flags when it intentionally disables Supabase for throwaway local clients.
• Nakama README documents required Supabase anonymous auth settings and fallback behavior.
• Nakama custom-auth tests now cover accepted token, rejected token, missing env config, missing token, and invalid Supabase user payload.

Verification:

• npm.cmd test in backend/nakama: pass
• npm.cmd run build in backend/nakama: pass
• npx.cmd markdownlint-cli2 "README.md" "CHANGELOG.md" "ROADMAP.md" "docs/**/*.md" "backend/nakama/README.md": pass
• powershell -NoProfile -ExecutionPolicy Bypass -File tools\windows\check-local-health.ps1 -Json: pass, no Unity compile/package blocker in recent Editor.log
• git diff --check: pass
• Em-dash scan for touched files: pass

Note: CoplayDev MCP port is listening, but its session endpoint currently returns no_unity_session, so Unity console verification used Editor.log health-check fallback for this pass.

[JOY]

Local code-review fallback update:

Verdict: APPROVED WITH RESIDUAL RISK.

Reviewed scope:

• Unity/Assets/_SecondSpawn/Scripts/AI/SecondSpawnGatewayClient.cs
• Unity/Assets/_SecondSpawn/Scripts/UI/HUDController.cs
• backend/nakama/tests/supabase_custom_auth.test.mjs
• backend/nakama/README.md
• docs/setup/local-fusion-dev-builds.md
• tools/launch-local-second-client.ps1
• tools/windows/check-local-health.ps1

Findings:

• No blocking architecture or LLM safety issue found.
• Auth fallback is now explicit instead of localhost-silent.
• Re-auth now clears stale Supabase/Nakama session state before a new attempt, so a failed retry cannot display an old session as current.
• Residual risk: CoplayDev MCP listener is up but currently returns no_unity_session, so this pass used Editor.log health-check fallback instead of live Unity console read.

Verification repeated after the stale-token fix:

• tools/windows/check-local-health.ps1 -Strict: pass, no Unity compile/package blocker in recent Editor.log
• git diff --check: pass
• Em-dash scan for touched files: pass

[JOY]

Implemented and merged in PR #173. Verification: Nakama npm ci/build/test passed locally; markdown lint passed; no conflict or em-dash markers in touched files; git diff check passed; local code-review fallback approved; CI lint and Nakama build + test passed after rerun of a transient checkout failure; root Unity recompile completed with no C# errors; Play Mode smoke ran with no errors. Remaining warning is the known Visual Studio UDP messaging warning.