Wired up Supabase auth — sign-up, sign-in, password reset, session restore — and row-level security on the budget tables. Once the first upload sets a baseline, local changes push automatically, each one fingerprinted so a stale device can’t clobber newer cloud data. Sync is the feature everyone gets subtly wrong, so I’m building the guardrails before the convenience.