#1040 feat(web): route signup through Capgo register API (leave Supabase Phase 1)

Summary

Phase 1 leave-Supabase slice for the marketing website. The /register/ page no longer calls GoTrue (supabase.auth.signUp) or the PostgREST is_not_deleted RPC.

Signup now POSTs to https://api.capgo.app/auth/register via a new client service.

Blocker

Production currently returns 404 for POST /auth/register. Signup shows a friendly error until Cap-go/capgo.app ships the handler.

See docs/leave-supabase-phase1-register-api.md for the request/response contract and server-side checklist.

What changed

• apps/web/src/services/registration.ts: HTTP client for POST /auth/register, error mapping, console redirect tokens.
• apps/web/src/pages/register.astro: Removed all supabase-js auth usage from the signup flow. Same validation, analytics hooks, and console handoff UX.
• apps/web/test/registration.test.js: Unit tests for payload shape and error mapping.
• docs/leave-supabase-phase1-register-api.md: API handoff doc for capgo.app.

Remaining Supabase usage in Cap-go/website

Location	Usage	Phase 1 status
apps/web/src/services/supabase.ts	supabase-js client + /private/config fetch for anon key/host	Still used indirectly by config endpoint; no runtime callers after this PR
apps/web/src/services/supabase.types.ts	Generated PostgREST types for plans/pricing UI	Still used (type-only imports in pricing components)
apps/web/test/supabase-config.test.js	Tests for config helpers	Kept
package.json (@supabase/supabase-js)	Dependency	Still installed; removable once config/types are decoupled
apps/web/src/pages/bug-bounty.astro, security.astro	Marketing copy mentioning Supabase	Content only, not runtime auth
Blog/docs content	Supabase plugin tutorials and redirects	Content only

Removed from runtime auth path: register.astro no longer imports @/services/supabase or calls auth.signUp, auth.getSession, or rpc('is_not_deleted').

Testing

• bun test apps/web/test/registration.test.js
• cd apps/web && bun run check

Next steps (capgo.app, not this PR)

1. Implement POST /auth/register per the handoff doc.
2. Move is_not_deleted server-side.
3. Deploy and verify end-to-end signup from https://capgo.app/register/

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}