Contractor finance & USDC payouts

Secure foundation is live: self-hosted Supabase auth, a least-privilege database role, and row-level security on contractors, invoices, and payouts. Build the dashboard from here.

Auth, RLS schema, and the payout security model are documented in the repo (SECURITY.md).