Build a Niche Job Board in Lovable

Build a niche job board. Stack assumptions: React + Vite + TypeScript + Tailwind + shadcn/ui (already scaffolded), React Router v6, Supabase JS client against Lovable Cloud.

## Database schema (create one migration)
Create five tables in the public schema:

1. `companies` — id (uuid pk default gen_random_uuid()), owner_id (uuid references auth.users(id) on delete set null), name (text not null), website (text), logo_path (text), description (text), created_at (timestamptz default now()). RLS: public SELECT; employer INSERT/UPDATE WHERE owner_id = auth.uid().

2. `jobs` — id (uuid pk default gen_random_uuid()), employer_id (uuid not null references auth.users(id)), company_id (uuid references companies(id)), title (text not null), description (text not null), location (text), remote_type (text check in ('onsite','hybrid','remote')), salary_min (int), salary_max (int), currency (text default 'USD'), employment_type (text check in ('full_time','part_time','contract','internship')), status (text default 'draft' check in ('draft','active','expired','removed')), is_paid_post (bool default false), posted_at (timestamptz), expires_at (timestamptz), created_at (timestamptz default now()). RLS: public SELECT TO anon, authenticated USING (status='active' AND expires_at > now()); employer INSERT/UPDATE/DELETE WHERE employer_id = auth.uid(); admin all via JWT app_metadata.role='admin'.

3. `profiles` — id (uuid pk references auth.users(id) on delete cascade), full_name (text), role (text default 'seeker' check in ('seeker','employer','admin')), email (text not null), headline (text), default_resume_path (text), created_at (timestamptz default now()). RLS: own read/write. Role here is a display mirror — auth role lives in JWT app_metadata.

4. `applications` — id (uuid pk default gen_random_uuid()), job_id (uuid references jobs(id)), seeker_id (uuid not null references auth.users(id)), resume_path (text not null), cover_letter (text), status (text default 'submitted' check in ('submitted','reviewed','shortlisted','rejected')), submitted_at (timestamptz default now()). RLS: seeker reads/inserts own WHERE seeker_id = auth.uid(); employer reads via SECURITY DEFINER function can_see_application(p_application_id uuid); NEVER public-read.

5. `job_alerts` — id (uuid pk default gen_random_uuid()), seeker_id (uuid references auth.users(id) on delete cascade), keyword (text), location (text), remote_type (text), frequency (text default 'daily' check in ('daily','weekly')), last_sent_at (timestamptz), created_at (timestamptz default now()). RLS: own read/write.

Create a SECURITY DEFINER plpgsql function `can_see_application(p_application_id uuid)` that runs as the function owner and returns true when auth.uid() = seeker_id OR auth.uid() = (SELECT employer_id FROM jobs WHERE id = (SELECT job_id FROM applications WHERE id = p_application_id)). Use LANGUAGE plpgsql only.

Enable RLS on all five tables.

Add a Storage policy for the resumes bucket (private, per-seeker folder scoping):
CREATE POLICY seekers_own_folder ON storage.objects
  FOR ALL TO authenticated
  USING (bucket_id = 'resumes' AND (storage.foldername(name))[1] = auth.uid()::text)
  WITH CHECK (bucket_id = 'resumes' AND (storage.foldername(name))[1] = auth.uid()::text);

Add pg_cron job expiry (run this at end of migration):
CREATE EXTENSION IF NOT EXISTS pg_cron;
SELECT cron.schedule('expire-jobs', '0 0 * * *', $$UPDATE jobs SET status='expired' WHERE expires_at < now() AND status='active';$$);

## Layouts
- `PublicLayout.tsx` — sticky header with logo, 'Post a Job' CTA button, Sign in / Sign up buttons, search bar. Footer with links.
- `EmployerLayout.tsx` — sidebar with: My Jobs, Applications, Company profile, Billing. AuthGuard reads JWT session.
- `SeekerLayout.tsx` — same header as PublicLayout + user dropdown with My Applications, Alerts, Account.
- `AdminLayout.tsx` — sidebar with Moderation. Checks JWT app_metadata.role='admin'.

## Pages
- / (Home) — hero with search input + 'Search jobs' button, 8 featured jobs (is_paid_post=true), recent 12 active jobs grid
- /jobs — jobs list with sidebar JobFilters: keyword input (debounced 300ms), location input, remote_type checkboxes (onsite/hybrid/remote), employment_type checkboxes, salary range slider. Results paginated 20/page, sorted by posted_at DESC with is_paid_post jobs pinned first.
- /jobs/:slug — job detail: title, company logo + name (link to company page), location + remote badge, salary range, employment_type badge, description (render as markdown), posted date, 'Apply Now' button (opens ApplicationDrawer for signed-in seekers, redirect to /signup?as=seeker for anon)
- /post — employer job posting wizard. Step 1: Company setup (name, website, logo upload, description). Step 2: Job details (title, description textarea, location, remote_type, salary range, employment_type). Step 3: Duration + payment — free posts last 14 days, paid ($99) last 30 days + featured. Free post: INSERT job with status='active', is_paid_post=false, expires_at=now()+14 days. Paid: call create-paid-post-session Edge Function.
- /employer/jobs — CRUD list of employer's own jobs. Each row: title, status badge (draft/active/expired), applications count, expires_at, Edit + View buttons. Edit opens a Sheet with the full job form.
- /employer/jobs/:id/applications — list of applications for that job. Each row: seeker name, submitted date, status dropdown (employer can update), resume download link (signed URL). Click row opens ApplicationDrawer with cover letter.
- /seeker/applications — seeker's own application history: job title, company, submitted date, status badge.
- /seeker/alerts — AlertsForm: keyword, location, remote_type preferences, frequency toggle (daily/weekly). Save button writes to job_alerts.
- /admin/moderation — active jobs list, flag count column, Remove button (sets status='removed')
- /login, /signup — standard auth pages. Signup has a ?as=employer or ?as=seeker query param that pre-selects the role and writes it to profiles.role + JWT app_metadata via a trigger.

## Key components
- `JobCard.tsx` — title (large weight), company name + logo (small), location + remote badge inline, salary range if provided, employment_type badge, 'Featured' badge if is_paid_post, posted_at relative time
- `JobFilters.tsx` — sticky sidebar with controlled inputs, 'Clear all' button
- `JobPostingForm.tsx` — multi-step form with react-hook-form
- `ResumeUploader.tsx` — shadcn file input, validates PDF type + max 5MB before upload, uploads to Storage path: `${user.id}/${file.name}`
- `ApplicationDrawer.tsx` — right Sheet showing resume download + cover letter for employer view; application status dropdown
- `AlertsForm.tsx` — keyword + location + remote_type + frequency controlled form

## Styling
Light mode default. Primary color: indigo-600. JobCard clear visual hierarchy: title big, company name subdued, salary and remote badge as inline pills. 'Featured' badge in amber-500. Mobile-first layout.

## Edge Function stubs (create files — I will deploy after)
1. supabase/functions/create-paid-post-session/index.ts — creates Stripe Checkout session for $99 with metadata.job_id, expires_at=now()+30 days in metadata. Returns { url }.
2. supabase/functions/stripe-webhook/index.ts — STUB with TODO: use req.text() + constructEventAsync. Mark the job active on checkout.session.completed.
3. supabase/functions/send-job-alerts/index.ts — stub for daily alert emails.

Generate migration first, then layouts, then pages in order above.