Enable managed auth in production

docs/managed-openrouter-migration-plan.md

@@ -91,6 +91,20 @@ create table users (
 3. `gleam-externals/agent.mjs`: fetch a fresh token via `clerk.session.getToken()` per request (Clerk tokens are short-lived) and send `Authorization: Bearer <jwt>` to `/api/agent`.
 
 > **Status (2026-06-10):** Code side implemented behind `VITE_MANAGED_AUTH` (off by default; old behavior unchanged): bundled `@clerk/clerk-js` (code-split chunk, no CDN script), boot gate in `src/main-gleam.ts` (`src/managed-auth.ts`), fresh `getToken()` per request to `/api/agent` (`src/managed-agent-client.ts`, unit-tested incl. 402 code mapping). Spike **validation** still requires a Render preview deploy with a Clerk dev instance — runbook in `docs/phase2-coep-spike.md`.
+>
+> **Status (2026-07-28): the COEP half of the spike PASSES.** Measured by serving
+> a real `VITE_MANAGED_AUTH=true` production build behind the same
+> `COEP: require-corp` + `COOP: same-origin` headers `render.yaml` sets, then
+> driving it in Chrome: `crossOriginIsolated === true` (so WebContainers still
+> work), Clerk's chunks load and initialize, **zero external origins are
+> requested**, and nothing is blocked by COEP. The `no-rhc` + bundled
+> `@clerk/ui` approach does what it was supposed to. Managed auth also builds
+> cleanly — ~240 code-split chunks, 4.4 MB total, none of it in the entry chunk.
+>
+> Still unvalidated, and needing real credentials: the **OAuth redirect
+> round-trip** (it leaves the origin and comes back, which a placeholder key
+> cannot exercise) and the **managed agent loop** — `/api/agent/step`,
+> `web_search`, `web_fetch`, `web_post` have only ever seen fixtures.
 
 **Success criteria (spike — gate for the rest of the phase):**
 

render.yaml

@@ -5,12 +5,21 @@ services:
     envVars:
       - key: GLEAM_VERSION
         value: 1.16.0
-      # Phase 5 rollout switch: off in production until the COEP spike passes
-      # and dogfooding is done; PR previews get the managed flow automatically.
-      # The production flip is: change this value to "true" (and the rollback
-      # is flipping it back — one deploy each way).
+      # Phase 5 rollout switch, flipped on 2026-07-28. Managed mode: users sign
+      # in with Clerk and the server provisions a per-user OpenRouter key, so
+      # nobody pastes their own.
+      #
+      # ROLLBACK is this value back to "false" — one deploy, no data migration
+      # (projects live in IndexedDB and are untouched either way).
+      #
+      # Two things must be true in the dashboards or this is not what it looks
+      # like: VITE_CLERK_PUBLISHABLE_KEY must be set below — unset silently
+      # falls back to BYOK, because isManagedAuthEnabled() requires BOTH — and
+      # Google must be enabled as a Clerk social connection, which on a
+      # production instance needs your own Google OAuth credentials rather than
+      # Clerk's shared development ones.
       - key: VITE_MANAGED_AUTH
-        value: "false"
+        value: "true"
         previewValue: "true"
       - key: VITE_CLERK_PUBLISHABLE_KEY
         sync: false