Authentication

Auth is handled by Clerk (@clerk/react-router)
User records are synced from Clerk via webhook at routes/api/webhooks/clerk.ts
Ownership validation: check ownerId field against the Clerk user ID (clerkId)
Admin access: isAdmin boolean on the users table; all /admin routes enforce this
League commissioners: stored separately in the commissioners table (not via isAdmin)