fix(auth): stop redirecting sign-in to the dead Vercel origin

signal-ui/src/main.jsx hardcoded WEBAPP_URL to https://signal-ui-xi.vercel.app
and passed it to signInUrl/signUpUrl/afterSignInUrl/afterSignUpUrl. The
production Clerk instance (clerk.sttilsolutions.com) rejects that origin with
400 origin_invalid on every write path, so sign-in was handed back to an origin
that cannot authenticate. Verified live: POST /v1/client/sign_ins returns 400
from the Vercel origin and 200/422 from signal.sttilsolutions.com.

Redirect target now derives from window.location.origin, overridable via
VITE_APP_URL, so it cannot drift from the deployed domain again. Also replaced
afterSignInUrl/afterSignUpUrl with signInFallbackRedirectUrl/
signUpFallbackRedirectUrl, deprecated in Clerk Core 2.

Build verified: pnpm build succeeds, dead Vercel URL absent from dist output.
NOT verified: a real sign-in completing end to end. Needs deploy first.

Also updates the pilot readiness table: hosted-URL row now names
signal.sttilsolutions.com (confirmed canonical by Kisa 2026-07-27), login row
moved from PASS to OPEN. Honest count 11/13 clean, 1 open, 1 disputed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Aqzsyo1PudjabuV9XQzxwp

CLAUDE.md

@@ -88,22 +88,25 @@ BAA; see the NEVER-CLAIM list in `docs/build-plans/03-game-center-token-layer.md
 
 Whitepaper: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Projects/2026-05-18-pilot-readiness-whitepaper.md`
 
-### Checklist Status (as of 2026-06-16) — 100% pilot-ready (13/13)
+### Checklist Status (updated 2026-07-27) — 11/13 clean, 1 open, 1 disputed
 
-> **STALE ROW WARNING, flagged 2026-07-26.** This table is dated 2026-06-16 and has
+> **Do not quote "100% pilot-ready" or 13/13.** Superseded 2026-07-27. The hosted-URL
-> not been re-verified since. The row "Demo login / controlled access working: PASS"
+> row is now correct (Kisa confirmed `signal.sttilsolutions.com` as canonical, so the
-> is **contradicted** by the CLERK LOGIN open thread in `context/current-state.md`
+> Clerk `origin_invalid` fault no longer applies to the URL under test). The login row
-> dated 2026-07-07, which records that Kisa cannot sign in to signal-ui-xi.vercel.app
+> is **not** clean: Clerk's `after_sign_in_url` still points at `https://sttilsolutions.com`,
-> and that this gates the P6 click-through. Both cannot be true. Until the Clerk bug
+> so a successful sign-in lands on the marketing site rather than the app. That fix
-> is resolved or the row is re-tested, **do not quote 13/13 or "100% pilot-ready"
+> needs a **production** Clerk secret (`sk_live_`) via the Backend API; the
-> to anyone external.** The file's own instruction below says to re-count before
+> `CLERK_SECRET_KEY` currently in `~/.claude/.secrets.env` is `sk_test_` and belongs to
-> quoting a percentage; re-counting is not enough if a row is stale, so re-test the
+> an unrelated **development** instance (`holy-gar-49.clerk.accounts.dev`, created
-> login row specifically.
+> 2026-06-29) — it authenticates with HTTP 200 against the wrong instance, which is why
+> its presence is not the same as the blocker being cleared.
+> The honest external number is **11 of 13 clean**. Re-test the login row after Fault B
+> is fixed; re-counting alone is not enough when a row is stale.
 
 | Checklist Item | Status |
 |---|---|
-| App hosted behind stable URL | PASS — <https://signal-ui-xi.vercel.app> (deployed 2026-05-29) |
+| App hosted behind stable URL | PASS — <https://signal.sttilsolutions.com> (confirmed canonical by Kisa 2026-07-27; the Vercel URL `signal-ui-xi.vercel.app` is NOT canonical and cannot authenticate) |
-| Demo login / controlled access working | PASS |
+| Demo login / controlled access working | **OPEN (2026-07-27)** — origin fault resolved by the canonical URL, but Clerk `after_sign_in_url` still redirects to the marketing site. Blocked on a production Clerk secret. Not a PASS. |
 | Synthetic sample data loads end to end | PASS — verified as Gaboro DME org 2026-06-10 |
 | 25 CSV variants pass ingestion tests | PASS — 50 new files generated (PA + NJ sets), 100% normalizer pass rate 2026-06-07 |
 | Import flow: mapping, validation, warnings | PASS — mapping review step built 2026-06-10; confidence display, override dropdown, unmapped column notice, required-missing notice all implemented in CSVImport.jsx |

signal-ui/src/main.jsx

@@ -10,16 +10,23 @@ if (!PUBLISHABLE_KEY) {
   throw new Error("Missing VITE_CLERK_PUBLISHABLE_KEY — add it to signal-ui/.env");
 }
 
-const WEBAPP_URL = "https://signal-ui-xi.vercel.app";
+// Where Clerk sends the user after sign-in, and where it points its own redirects.
+// Defaults to the host the app is actually being served from, so this can never
+// again drift out of sync with the deployed domain. Override with VITE_APP_URL
+// only if a deploy must redirect somewhere other than its own origin.
+// Previously hardcoded to https://signal-ui-xi.vercel.app, which the production
+// Clerk instance rejects (origin_invalid), so every sign-in redirected into an
+// origin that could not authenticate.
+const APP_URL = import.meta.env.VITE_APP_URL ?? window.location.origin;
 
 createRoot(document.getElementById("root")).render(
   <StrictMode>
     <ClerkProvider
       publishableKey={PUBLISHABLE_KEY}
-      signInUrl={WEBAPP_URL}
+      signInUrl={APP_URL}
-      signUpUrl={WEBAPP_URL}
+      signUpUrl={APP_URL}
-      afterSignInUrl={WEBAPP_URL}
+      signInFallbackRedirectUrl={APP_URL}
-      afterSignUpUrl={WEBAPP_URL}
+      signUpFallbackRedirectUrl={APP_URL}
     >
       <App />
     </ClerkProvider>