Start Sign in with Supabase

Returns the Supabase authorization URL to send the person to. When they return, list the projects the sign-in can see with the state, then finish one as a connection. The grant is read twice and forgotten; the vault keeps the project's own S3 session credential.