app shell and providers

src/main.tsx nests:

1. StrictMode
2. HelmetProvider
3. QueryClientProvider (retry: 1, staleTime: 5 min)
4. AuthProvider
5. TooltipProvider
6. RouterProvider

NuqsAdapter lives on the root route, not in main.tsx. Root route is only that adapter plus <Outlet />. No chrome layout. Every page paints its own terminal frame (term-window, CRT grid).

If VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY are missing, supabase is null, isConfigured is false, and the dashboard still works. requireSupabase() throws with those env names. Public /$profileUsername then renders “Saved profiles are not configured”, not a 404.

Google OAuth via signInWithOAuth. redirectTo is the current URL or origin + next. Login validateSearch only keeps next if it starts with /.

/onboarding is an alias of /account (legacy OAuth redirect). README still tells you to allow-list /onboarding.

Catch-all /$profileUsername is last in the child list so it cannot eat /app, /login, /github/$username. defaultNotFoundComponent is NotFoundPage. Vercel last rewrite is /(.*) -> /index.html, which is why the catch-all can be a client route.

Login and account strip unsafe next.