Sign in once for upload, readiness, AP review, and queue actions.

Browser actions now use the active Supabase session instead of pasted bearer tokens. Role checks still happen in Supabase functions before any finance data changes.