HOTSTOCK — going live on Hostinger with Supabase sync
=====================================================

Do these steps in order. The whole job takes about 10 minutes.

-----------------------------------------------------
STEP 1 — Run the SQL once in Supabase
-----------------------------------------------------
1. Open the Supabase Dashboard and go to your GCP Props project
   (the same project Inventory and Playback use — HOTSTOCK gets its
   own hotstock_ tables, so nothing clashes).
2. Open SQL Editor → New query.
3. Paste in the whole of:  assets/hotstock-supabase.sql
4. Click Run. You should see "Success. No rows returned".
   (It is safe to run again later — it only adds anything missing
   and never wipes data.)

-----------------------------------------------------
STEP 1B — Create the first Admin account (one-time)
-----------------------------------------------------
Admin sign-in is real Supabase Auth — there is no admin code in
HOTSTOCK any more.
1. In the Supabase Dashboard go to Authentication → Users →
   "Add user" and create the admin's email + password account.
2. Back in the SQL Editor, run this one line with their email:
     insert into public.hotstock_admins (user_id, email)
     select id, email from auth.users
     where email = 'ADMIN-EMAIL-HERE'
     on conflict (user_id) do nothing;
3. That person can now tap Admin in HOTSTOCK and sign in with
   that email and password.
Security, enforced by Supabase (not by the page): Viewers who
never sign in can only READ. Only accounts listed in
hotstock_admins can add/edit/delete, and only they can see or
manage Users/codes. Add or remove admins the same way — another
insert, or delete their row from hotstock_admins.

-----------------------------------------------------
STEP 2 — Fill in the sync config
-----------------------------------------------------
1. In the Supabase Dashboard go to Project Settings → API.
2. Open this file in a text editor:  assets/hotstock-config.js
3. Replace  YOUR-SUPABASE-PROJECT-URL  with the Project URL.
4. Replace  YOUR-SUPABASE-ANON-KEY   with the "anon public" key.
5. Save the file.
   Until this is filled in, HOTSTOCK still works for browsing and
   exports, but local-only and VIEWER-ONLY: each device keeps its
   own copy, nothing syncs, and Admin sign-in stays off — Admin
   needs the Supabase Auth setup (Steps 1 and 1B) by design, so
   there is no code or password inside the page to fall back on.

-----------------------------------------------------
STEP 3 — Upload to Hostinger, fresh
-----------------------------------------------------
1. In Hostinger File Manager, open the folder HOTSTOCK lives in
   (e.g. public_html / hotstock.greencouch.ca).
2. DELETE the old HOTSTOCK files in that folder first — the old
   index.html and the old assets folder. (Deleting first stops an
   old cached copy mixing with the new synced one.)
3. Upload the new files fresh:
      index.html
      assets/avocado.png
      assets/hotstock-config.js      (the one you filled in, Step 2)
      assets/hotstock-supabase.sql   (kept on the server so the menu's
                                      "Supabase SQL" link works)
      assets/HOSTINGER-SETUP.txt     (this file, for the menu link)
4. Check the assets folder on the server really contains all four
   asset files.

-----------------------------------------------------
STEP 4 — Hard refresh and check sync
-----------------------------------------------------
1. Open the HOTSTOCK address in your browser.
2. Hard refresh so no old copy is cached:
      Mac:  Cmd + Shift + R
      PC:   Ctrl + Shift + R
      Phone: close the tab completely and reopen the address.
3. Open the ☰ menu (top right). The sync line at the bottom of
   the menu should say:
      "Sync: on — showing the latest from Supabase…"
   If it says "local only", the config in Step 2 is not filled in
   or was not uploaded.
4. Test it: tap Admin and sign in with the admin email/password
   from Step 1B, then add a test bin. On a second device (or a
   private/incognito window), open HOTSTOCK without signing in —
   you are a Viewer, and the test bin should be there to read.
   Delete the test bin when you are done — that delete syncs too.

-----------------------------------------------------
How sync behaves day to day
-----------------------------------------------------
- Every change (shows, seasons, bins, props, photos, users/codes)
  saves to Supabase automatically a moment after you make it.
- Other devices pick up the latest when they open HOTSTOCK, when
  they refresh, or when they come back to the app.
- Adding a new season asks if you want to transfer bins from the
  previous season into it.
- If Supabase is ever unreachable, HOTSTOCK keeps working locally
  and says so on the sync line in the ☰ menu.