fix: allow email OTP signups and track production auth schema

src/lib/supabase/AuthProvider.tsx

@@ -280,7 +280,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
 
       const { error } = await supabase.auth.signInWithOtp({
         email: normalizedEmail,
-        options: { shouldCreateUser: false },
+        options: { shouldCreateUser: true },
       });
       if (error) throw error;
     },

src/test/auth/AuthProvider.behavior.test.tsx

@@ -416,7 +416,7 @@ describe('AuthProvider behavior', () => {
     });
   });
 
-  it('sends an email OTP for the normalized email address', async () => {
+  it('allows email OTP signup for the normalized email address', async () => {
     render(
       <AuthProvider>
         <PasswordlessAuthConsumer />
@@ -428,7 +428,7 @@ describe('AuthProvider behavior', () => {
     await waitFor(() => {
       expect(signInWithOtpMock).toHaveBeenCalledWith({
         email: 'student@example.com',
-        options: { shouldCreateUser: false },
+        options: { shouldCreateUser: true },
       });
     });
   });

supabase/migrations/20260907155821_reconcile_user_roles_updated_at.sql

@@ -0,0 +1,4 @@
+-- Production's legacy user_roles table predates the updated_at column used by
+-- current admin and demo-code upserts. Newer environments already have it.
+ALTER TABLE public.user_roles
+ADD COLUMN IF NOT EXISTS updated_at timestamptz NOT NULL DEFAULT now();