Prove auth config works by signing in with deliberately wrong credentials

After wiring up a hosted auth provider locally, a failed login tells you nothing on its own — a DNS error against a placeholder host and a genuine rejection both just look like "login broken" in the UI. Call signInWithPassword with a junk email and password and read the error: a fast 400 with "Invalid login credentials" proves the request reached the real project and was understood, whereas a network/name-resolution error means the client is still pointed at nothing. Also decode the JWT payload of any key before letting it near frontend code — anon and service_role tokens look identical from outside and only differ in the role claim, and service_role in the browser bypasses row-level security for every visitor.