1. User logs in with Google or Apple
2. signInWithPopup
3. AuthContext onIdTokenChanged triggers
4. at the same time, 1. run an api call to user/by-id/:id which reads from supabase and 2. from the client read the private user doc from firebase
5. user returns null, so create user code path
6. firebase auth user created
7. new user and private user inserted