#373 fix(auth): use Authorization header for cross-subdomain tRPC auth

Summary

• Sends Clerk session token via Authorization header instead of relying on cross-subdomain cookies
• Admin tRPC client uses useAuth().getToken() to get token and sends it as Bearer token
• API context verifies Clerk tokens from Authorization header using verifyToken() from @clerk/backend
• Unhides the Sign In button on the marketing site

Problem

Clerk intentionally sets session cookies scoped to specific subdomains for security - they explicitly don't share cookies across subdomains. When the admin app's client-side code made tRPC requests to api.superset.sh, the cookies weren't sent (different subdomain).

From Clerk docs:

"The session cookie domain is set on your application's domain directly, scoped strictly so it cannot be shared across subdomains."

Solution

Instead of trying to share cookies, we now pass the Clerk session token via Authorization header, which is the recommended approach from Clerk:

"If you need to send the session token value across subdomain boundaries, you can put the token in a request header instead."

Test plan

• Deploy to preview/staging
• Verify admin app Users page loads without "Not authenticated" error
• Verify sign in works across all apps
• Verify desktop app auth still works (uses same Authorization header flow)

🤖 Generated with Claude Code