Blogen used to be two processes: a Create React App client talking to Express, with MongoDB and Firebase Storage behind it. That split made public pages slower than they needed to be and left auth in localStorage.
What changed
The rewrite keeps the screens you already know and moves data access into Next.js Server Components and Server Actions. Postgres, Auth, and Storage now live in one Supabase project.
Row Level Security is the real API boundary. The browser can read published posts; writing still requires a session, and admin flags stay in profiles rather than in editable user metadata.