Update README with real setup instructions

README.md

@@ -1,7 +1,65 @@
 # supabase_test
 
-Minimal to-do list. React (Vite+TypeScript) frontend, ASP.NET Core Web API backend, Supabase for auth and Postgres.
+Minimal per-user to-do list.
 
-See [`docs/superpowers/specs/2026-08-15-supabase-todo-app-design.md`](docs/superpowers/specs/2026-08-15-supabase-todo-app-design.md) for the design.
+- **Frontend:** React 19 + TypeScript, built with Vite. Uses `@supabase/supabase-js` only for authentication.
+- **Backend:** ASP.NET Core 9 Web API. Validates Supabase-issued JWTs against the project's JWKS (via OpenID discovery), talks to Postgres directly with EF Core + Npgsql.
+- **Auth + DB:** Supabase.
 
-Setup instructions land here after the app is wired up.
+See [the design doc](docs/superpowers/specs/2026-08-15-supabase-todo-app-design.md) for the architecture and rationale, and [the implementation plan](docs/superpowers/plans/2026-08-15-supabase-todo-app.md) for how it was built.
+
+## Prerequisites
+
+- .NET SDK 9.0
+- Node.js 20+
+- A Supabase project (URL, publishable key, Postgres password, and session-pooler hostname)
+
+## One-time setup
+
+1. **Apply the database migration to your Supabase project.** Either:
+   - Open the Supabase dashboard → SQL Editor → paste `migrations/001_create_todos.sql` → Run, or
+   - `PGPASSWORD='<db-password>' psql "host=aws-<n>-<region>.pooler.supabase.com port=5432 dbname=postgres user=postgres.<project-ref> sslmode=require" -f migrations/001_create_todos.sql`
+2. **Disable email confirmation for dev.** Supabase dashboard → Authentication → Providers → Email → toggle **Confirm email** off, so sign-up returns a session immediately.
+3. **Backend config:**
+   ```bash
+   cp backend/appsettings.Development.example.json backend/appsettings.Development.json
+   # Fill in: the pooler host/region, your project ref, and the DB password.
+   ```
+   The connection string uses Supabase's **session pooler** (port 5432, IPv4). The direct host `db.<ref>.supabase.co` is IPv6-only on new projects and won't reach from IPv4-only environments. Grab the exact URL from Supabase dashboard → Project Settings → Database → Connection string → "Session pooler" tab.
+4. **Frontend config:**
+   ```bash
+   cp frontend/.env.example frontend/.env.local
+   # Fill in VITE_SUPABASE_URL, VITE_SUPABASE_PUBLISHABLE_KEY, VITE_API_URL.
+   ```
+5. **Install frontend deps:**
+   ```bash
+   cd frontend && npm install
+   ```
+
+## Run it
+
+Two terminals:
+
+```bash
+# Terminal 1 — backend on http://localhost:5057
+cd backend && dotnet run
+
+# Terminal 2 — Vite dev server on http://localhost:5173
+cd frontend && npm run dev
+```
+
+Open <http://localhost:5173>, sign up, add todos.
+
+## Layout
+
+```
+backend/       ASP.NET Core Web API
+frontend/      Vite + React + TypeScript SPA
+migrations/    Plain SQL files applied to Supabase Postgres
+docs/          Design and implementation-plan docs
+```
+
+## Notes
+
+- Row Level Security is deliberately off on the `todos` table — the .NET API is the only writer and enforces ownership via `WHERE user_id = @currentUser` in every query. If you ever want the browser to talk to PostgREST directly, turn RLS on and write policies first.
+- No automated tests in this first pass. `docs/superpowers/plans/…` lists manual verification steps used during construction (curl for backend, browser for frontend).