feat(auth): add email/password login restricted to @craze.de accounts

- src/lib/auth.ts: signIn/signOut/getStoredSession via Supabase Auth REST API
- src/components/LoginPage.tsx: login form with domain validation UI
- src/components/TopBar.tsx: show logged-in user email + sign out button
- src/App.tsx: gate entire app behind auth — shows LoginPage if no session

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/auth.ts

@@ -0,0 +1,51 @@
+const SUPABASE_URL = 'https://hwithddwaapyhnfwcesj.supabase.co';
+const SUPABASE_ANON_KEY = 'sb_publishable_fGXkh0bSrAOqSk2jWKAzSg_NJD9YPCv';
+const ALLOWED_DOMAIN = '@craze.de';
+const SESSION_KEY = 'craze_auth_session';
+
+export interface AuthSession {
+  access_token: string;
+  user: { id: string; email: string };
+}
+
+export async function signIn(email: string, password: string): Promise<AuthSession> {
+  if (!email.toLowerCase().endsWith(ALLOWED_DOMAIN)) {
+    throw new Error(`Only ${ALLOWED_DOMAIN} email addresses are allowed.`);
+  }
+
+  const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=password`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'apikey': SUPABASE_ANON_KEY,
+    },
+    body: JSON.stringify({ email, password }),
+  });
+
+  if (!response.ok) {
+    const err = await response.json().catch(() => ({}));
+    throw new Error(err.error_description || err.message || 'Invalid email or password.');
+  }
+
+  const data = await response.json();
+  const session: AuthSession = {
+    access_token: data.access_token,
+    user: { id: data.user.id, email: data.user.email },
+  };
+
+  localStorage.setItem(SESSION_KEY, JSON.stringify(session));
+  return session;
+}
+
+export function signOut(): void {
+  localStorage.removeItem(SESSION_KEY);
+}
+
+export function getStoredSession(): AuthSession | null {
+  try {
+    const raw = localStorage.getItem(SESSION_KEY);
+    return raw ? (JSON.parse(raw) as AuthSession) : null;
+  } catch {
+    return null;
+  }
+}