Phase 3 — Remaining auth gaps

[ludakhris]

Carryover from the original Phase 3 (Clerk auth). Baseline auth shipped — these are the leftover items.

Scope

• Institutional email domain detection — when a user signs in with someone@acme.edu, look up acme.edu in the institutions table and auto-assign them. Foundation for cohort self-join (see Phase 6 — Institution analytics dashboard #2).
• Session persistence across devices — verify Clerk session config persists across browser sessions and devices the way we want; document the expected behaviour and any tweaks needed.

Related

• Phase 6 — Institution analytics dashboard #2 covers the cohort/institution data-model work this depends on.
• Post-pilot: institutional SSO via SAML/OIDC tracked separately.