View an auth-gated SPA locally by forging the auth SDK's persisted session

To work on UI behind a login wall with no account and no backend, write the session object the auth SDK persists into localStorage — route guards typically only check that a session exists, not that its JWT verifies, so the shell renders. Do not guess the storage key: import the client module in the page and read it off the instance (supabase-js exposes auth.storageKey, derived from the project URL, so it changes when the URL does). Be explicit that this is not a login — the token is unsigned, so API calls still 401; pair it with the backend's own auth-skip flag and matching user id if you want data too. Related trap when debugging why local login fails at all: bundlers only expose prefixed vars to client code (VITE_*, NEXT_PUBLIC_*), so a key pasted into the server .env is invisible to the browser, and a fresh git worktree never inherits untracked .env.local files.