Sign in with a real account.

Auth.js + bcrypt is now the front door. Shared Postgres board storage is the next layer, not a hand-wavy promise.