Provider Config

Serve the authorization page the Supabase values a browser may hold.

Three, and deliberately not the fourth: the publishable key is browser-safe by definition, the project URL and the OAuth client id are already public in the authorization redirect every sign-in follows, and supabase_oauth_client_secret is the one value here that would turn this unauthenticated GET into a credential leak. Serving the other three rather than baking them into the bundle keeps the frontend build environment-free, which is how the rest of the SPA already works.