Give Cursor a real backend: Postgres, auth and storage

{
  "mcpServers": {
    "scribase": {
      "url": "https://api.scribase.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SCRIBASE_ACCESS_TOKEN}"
      }
    }
  }
}

---
description: Scribase backend rules
alwaysApply: true
---

## Scribase backend
- The backend is Scribase (Postgres, Auth, Storage, Realtime). App code uses @supabase/supabase-js with the URL and anon key that `npx scribase init` writes.
- Never ask me for keys. To sign in, run `scribase login --json`, show me the link and code, and wait for my approval.
- Schema changes are SQL files in supabase/migrations/, rehearsed on a preview branch; every new table enables row-level security with owner policies.
- Merging into production, deleting environments and rotating keys need my explicit approval for that operation.
- Never print, log or commit keys. Full rules: https://docs.scribase.com/llms.txt

Build me a small app with sign-in and a todo list, on a Scribase backend.
1. Run `npx scribase init --yes --json` in the project root. If it returns authorization_pending, show me the link and code, wait until I approve, then run it again.
2. Create a `todos` table owned by the signed-in user, with row-level security so each user only sees their own rows. Use the Scribase MCP tools (policy.test before schema.apply), not the service-role key.
3. Add email sign-in and the todo screen using the generated client.
4. Never print, log or commit the env file.