[regeloapp-coder]

Summary

• Add the Supabase and Supabase Postgres best-practices Agent Skills.
• Harden Keystore-backed session storage, GDPR export/deletion cleanup, push-token cleanup, reading completion, server-clock challenge state, and concurrent rate limiting; remove destructive Room migration fallback.
• Improve authoring UX: opening a new story enters its first chapter, and owners can delete their stories from editor/detail with confirmation and ownership checks.
• Add tested swipe-based chapter navigation and discovery shelves (new stories, recently publishing authors, popular stories) to the home screen.
• Require a complete protected release-signing configuration instead of using a debug key, ignore signing artifacts, and document Android release steps and store blockers.

Database rollout

supabase/2026-10-26_app_v1_4.sql was applied to the active Supabase project pqmfezkvaslqedalwwnn; transactional checks passed and test data was rolled back. Apply the migration to each other target environment before deploying the updated client there.

Validation

• :app:testDebugUnitTest
• :app:assembleDebug
• :app:assembleRelease
• git diff --check
• Remote v1.4 database checks

Release and scope limitations

The successful release assembly did not use a store keystore and is not a store-signed AAB. A real signed bundle, versionCode increment, public external account-deletion URL, and Play Console disclosures are still required. No Android device/emulator was attached for UI end-to-end tests. The local Room database is excluded from backup but does not have SQLCipher/app-layer encryption. This repository is Android-only; there is no iOS project or Vite Messages.jsx implementation. The discovery feed is additive and retains the existing reader library; moving all authored work and drafts exclusively under Profile remains out of scope for this patch.