docs: record native auth deployment and production verification

README.md

@@ -163,6 +163,6 @@ npm run dev       # local dev — create a .dev.vars with AUTH_TOKEN=<anything>
 
 ## Hosted accounts (public beta)
 
-An optional, separate hosted deployment supports email/password accounts with recovery codes (no email delivery), private file pools, revocable device tokens and strict account/global usage limits. [Try the hosted beta](https://shotsync-hosted.defiabell.workers.dev) (100 accounts). It runs on Workers Free, but measured login CPU exceeds the nominal free budget and may be throttled under load. Deployment prerequisites and limits are in [docs/hosted.md](docs/hosted.md). Existing self-hosted and read-only demo deployments keep their current behavior. Tooling now requires Node.js 22+.
+An optional, separate hosted deployment supports email/password accounts with recovery codes (no email delivery), private file pools, revocable device tokens and strict account/global usage limits. [Try the hosted beta](https://shotsync-hosted.defiabell.workers.dev) (100 accounts). It runs on Workers Free with Supabase Auth. Recent login CPU samples were 27, 9 and 10 ms: the first still exceeded the nominal 10 ms budget, so capacity under load is not established. Deployment prerequisites and limits are in [docs/hosted.md](docs/hosted.md). Existing self-hosted and read-only demo deployments keep their current behavior. Tooling now requires Node.js 22+.
 
 Hosted authentication delegates passwords and browser sessions to Supabase Auth. Operators need a dedicated personal project; website registration uses server-side admission checks while public Supabase signup stays disabled. See the migration and failure-recovery notes in the hosted guide.

README.zh-CN.md

@@ -155,6 +155,6 @@ npm run dev       # 本地开发 —— 建一个含 AUTH_TOKEN=<任意串> 的
 
 ## 托管账号版（公开试用）
 
-可独立部署邮箱＋密码注册／登录、恢复码重置密码（无需发邮件）、多用户文件隔离、设备令牌和账号／全站限额。[打开托管服务](https://shotsync-hosted.defiabell.workers.dev)。当前免费版试用，限 100 个账号；登录 CPU 实测仍超过免费版标称预算，高负载下可能受限。部署与限制见 [docs/hosted.md](docs/hosted.md)。现有自部署和只读 demo 保持原有使用方式；开发工具链需要 Node.js 22+。
+可独立部署邮箱＋密码注册／登录、恢复码重置密码（无需发邮件）、多用户文件隔离、设备令牌和账号／全站限额。[打开托管服务](https://shotsync-hosted.defiabell.workers.dev)。当前使用 Supabase Auth，在免费版试用，限 100 个账号；登录 CPU 三次实测为 27、9、10 ms，首次仍超过免费版标称 10 ms，尚未验证高负载容量。部署与限制见 [docs/hosted.md](docs/hosted.md)。现有自部署和只读 demo 保持原有使用方式；开发工具链需要 Node.js 22+。
 
 托管认证由 Supabase Auth 处理密码和浏览器会话，运营者需配置独立个人项目。网站注册先由服务端检查人数上限，Supabase 公开注册保持关闭；迁移、上线状态与故障处理见部署文档。

docs/hosted.md

@@ -2,7 +2,7 @@
 
 > This guide is for operators running a multi-user service. To deploy a personal pool without accounts, use the [default README instructions](../README.md#deploy-your-own-5-min): Worker + R2 + `AUTH_TOKEN`, with no D1 or Supabase. See [mode selection](deployment-modes.md).
 
-The hosted entry point (`src/hosted/index.ts`) adds email/password accounts with recovery codes and private per-account pools. It is a separate Worker, D1 database and R2 bucket. Existing personal deployments and the read-only demo retain their token-based behavior. The existing [hosted beta](https://shotsync-hosted.defiabell.workers.dev) still uses the previous local password implementation until the managed-auth migration below is configured and deployed; email delivery and a sender domain are not required.
+The hosted entry point (`src/hosted/index.ts`) adds email/password accounts with recovery codes and private per-account pools. It is a separate Worker, D1 database and R2 bucket. Existing personal deployments and the read-only demo retain their token-based behavior. The [hosted beta](https://shotsync-hosted.defiabell.workers.dev) uses Supabase Auth for passwords and browser sessions; email delivery and a sender domain are not required.
 
 ## What people can do
 
@@ -84,4 +84,6 @@ Launch preparation (2026-09-19): dedicated D1/R2/Turnstile resources, all three
 
 Launch verification (2026-09-20): PR #4 deployed as `b20bde51-2865-4464-a784-1a7e3f51b370`; both secrets are installed and the one-minute cleanup cron is registered. Homepage returns 200 and invalid Turnstile registration returns 403. Five unknown-account login probes (which perform the same PBKDF2/HMAC work) returned 401 normally, with **27–46 ms CPU**, down from prior scrypt probes of 172–326 ms. This still exceeds the documented Workers Free 10 ms CPU budget: burst tolerance allowed these requests, and reliable login under load is not established. No paid upgrade was made and the KDF was not weakened further. Successful login/upload/sharing were verified in the isolated local browser; production registration/recovery remain dependent on a real Turnstile challenge. 115 automated tests, TypeScript, dry run and independent code review passed.
 
-Managed-auth implementation status (2026-09-20): provider adapter, persistent registration/recovery state and tests are implemented. Personal Supabase project credentials are now supplied and encrypted in the private secrets vault; the server secret is installed in Cloudflare. Real provider create/login/password-update/old-password-rejection tests passed and the disposable fixture was removed. Public signup and email confirmation are now disabled, with email/password login enabled. Real native ES256 login, refresh, logout, and same-password recovery invalidation of old refresh tokens have passed through an isolated Worker connected to the personal provider. Temporary provider fixtures were removed. The native-session migration is undergoing final review before deployment. No migration 0004 or managed-auth deployment has been performed, and no production CPU improvement is claimed for this version. Store the project URL/secret in a mode-0600 local env file outside the repo, then back it up encrypted in the personal secrets vault.
+Native-auth rollout (2026-09-20): PR #6 merged as `549d334`; migration 0004 applied and Worker `b1507860-be09-414c-805a-2b98216b2370` deployed. Supabase settings and both keys are verified; public signup and email confirmation remain disabled, with website registration handled by ShotSync. Production had zero accounts before migration. Three real production login/refresh/logout rounds passed, including immediate denial of old JWTs and refresh tokens. Exact disposable D1/provider fixtures were removed. Real provider same-password recovery invalidated the prior refresh token in an isolated Worker. Browser tests cover registration, recovery, files, devices and refresh failures; production registration with a human Turnstile challenge has not been completed by automation.
+
+Measured production CPU for this version: login **27, 9, 10 ms**, successful refresh **8, 8, 6 ms**, successful list requests **5–9 ms**, and logout **4–5 ms**. All probes completed normally. The first observed login still exceeded the documented 10 ms Free budget, so these small samples do **not** establish reliable capacity or guarantee every request fits. No paid upgrade was made. The one-minute cleanup schedule remains installed. Store operator credentials in a mode-0600 local env file outside the repo and back it up encrypted in a private vault.