The OAuth-only 'sb-token' localStorage key was read by profile, slip,
dashboard (recent-scans), settings, and tracker for their authenticated
fetches. Email/password users never had that key, so those fetches sent
no Authorization header and silently returned nothing.
- web/src/lib/authToken.js — currentAccessToken() reads the REAL Supabase
session (sb-<ref>-auth-token, v2 top-level or v1 currentSession), legacy
fallback. CommonJS so Jest can unit-test it (5 tests).
- Swept all 5 pages to the helper (scan already session-first from DS1).
- lib/api.ts (0 callers) + ParlayTray (unmounted) left as dead code.
236 suites / 2842 tests green, next build exit 0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
builtbykev
cf91c04e90