Clerk auth demo

Sign in and sign up with Clerk. Gate routes using publicMetadata.groups (same names as the Cognito demo: bouncepass, alumni, tipping).