Hosted sign-in across instance domains [Flow]

Email/mobile stay the sign-in methods; the work is making one gateway session valid on each instance's own hosting domain (subdomain or custom) — via a token hand-off, not a shared cookie. Context: the platform model.

flowchart TB
    Sign["Director signs in ONCE at meridians.global<br/>(email magic-link/OTP · mobile OTP)"] --> Sess["Supabase session (gateway)"]
    Sess -->|opens their instance| HO["short-lived **one-time token** hand-off"]
    HO --> Sub["&lt;slug&gt;.meridians.global<br/>wildcard cert + one wildcard allowlist entry"]
    HO --> Cust["app.acme.com — custom domain<br/>per-domain Fly cert + allowlist on verify/teardown"]
    Allow["Supabase redirect allowlist =<br/>meridians.global + *.meridians.global + each custom domain"] -.->|spans them all| Sub
    Allow -.-> Cust

The hand-off is what keeps the session portable without a shared cookie: sign in once centrally, exchange a one-time token at each instance's own origin.