feat: add auth system, boss pokemon details, moves/abilities API, and run ownership

Add user authentication with login/signup/protected routes, boss pokemon
detail fields and result team tracking, moves and abilities selector
components and API, run ownership and visibility controls, and various
UI improvements across encounters, run list, and journal pages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/api/client.ts

@@ -1,3 +1,5 @@
+import { supabase } from '../lib/supabase'
+
 const API_BASE = import.meta.env['VITE_API_URL'] ?? ''
 
 export class ApiError extends Error {
@@ -10,11 +12,21 @@ export class ApiError extends Error {
   }
 }
 
+async function getAuthHeaders(): Promise<Record<string, string>> {
+  const { data } = await supabase.auth.getSession()
+  if (data.session?.access_token) {
+    return { Authorization: `Bearer ${data.session.access_token}` }
+  }
+  return {}
+}
+
 async function request<T>(path: string, options?: RequestInit): Promise<T> {
+  const authHeaders = await getAuthHeaders()
   const res = await fetch(`${API_BASE}/api/v1${path}`, {
     ...options,
     headers: {
       'Content-Type': 'application/json',
+      ...authHeaders,
       ...options?.headers,
     },
   })

frontend/src/api/journal.ts

@@ -5,10 +5,7 @@ import type {
   UpdateJournalEntryInput,
 } from '../types/journal'
 
-export function getJournalEntries(
-  runId: number,
-  bossResultId?: number
-): Promise<JournalEntry[]> {
+export function getJournalEntries(runId: number, bossResultId?: number): Promise<JournalEntry[]> {
   const params = bossResultId != null ? `?boss_result_id=${bossResultId}` : ''
   return api.get(`/runs/${runId}/journal${params}`)
 }

frontend/src/api/moves.ts

@@ -0,0 +1,30 @@
+import { api } from './client'
+import type { MoveRef, AbilityRef } from '../types/game'
+
+export interface PaginatedMoves {
+  items: MoveRef[]
+  total: number
+  limit: number
+  offset: number
+}
+
+export interface PaginatedAbilities {
+  items: AbilityRef[]
+  total: number
+  limit: number
+  offset: number
+}
+
+export function searchMoves(search: string, limit = 20): Promise<PaginatedMoves> {
+  const params = new URLSearchParams()
+  if (search) params.set('search', search)
+  params.set('limit', String(limit))
+  return api.get(`/moves?${params}`)
+}
+
+export function searchAbilities(search: string, limit = 20): Promise<PaginatedAbilities> {
+  const params = new URLSearchParams()
+  if (search) params.set('search', search)
+  params.set('limit', String(limit))
+  return api.get(`/abilities?${params}`)
+}