docs(tanstack): add a proper SSR quick start with cookie-based auth (#48105)

## Summary

TanStack Start's quickstart only ever wired up an anonymous
`supabase-js` client — no cookies, no `@supabase/ssr`, no auth. This
ports the real `@supabase/ssr` client/server split and password-based
auth flow (already shipped in `apps/ui-library`) into the quickstart and
adds a matching tab to the SSR guide.

## Where this changed

- `apps/docs/content/guides/getting-started/quickstarts/tanstack.mdx` —
quickstart now installs the cookie-based auth flow via the Supabase UI
Library registry and queries data through the SSR-aware server client.
- `apps/docs/content/guides/auth/server-side/creating-a-client.mdx` —
new TanStack Start tab (client/server setup + protecting routes).
- `examples/auth/tanstack/` (new) — source files backing the
`$CodeSample` snippets above, ported from `apps/ui-library`'s registry.

## Test plan

- [x] Scaffolded a real TanStack Start app and ran the quickstart
commands end-to-end
- [x] Confirmed SSR loader + protected-route redirect work as documented
- [x] `pnpm lint:mdx` and `pnpm build:guides-markdown` pass

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added TanStack Start SSR setup examples for Supabase, including
browser and server client helpers with cookie-based session support.
* Included a protected route example that checks authentication on the
server and redirects unauthenticated users to the login page.
  * Added a server-side claims fetch helper for authorization checks.
* **Documentation**
* Expanded the “creating a client” guide with TanStack Start-specific
route protection and environment variable examples.
* Updated the TanStack Start quickstart to use the official CLI and
refined server-side authorization guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

examples/auth/tanstack/lib/supabase/client.ts

@@ -0,0 +1,9 @@
+/// <reference types="vite/types/importMeta.d.ts" />
+import { createBrowserClient } from '@supabase/ssr'
+
+export function createClient() {
+  return createBrowserClient(
+    import.meta.env.VITE_SUPABASE_URL!,
+    import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY!
+  )
+}

examples/auth/tanstack/lib/supabase/fetch-claims-server-fn.ts

@@ -0,0 +1,14 @@
+import { createServerFn } from '@tanstack/react-start'
+
+import { createClient } from '@/lib/supabase/server'
+
+export const fetchClaims = createServerFn({ method: 'GET' }).handler(async () => {
+  const supabase = createClient()
+  const { data, error } = await supabase.auth.getClaims()
+
+  if (error) {
+    return null
+  }
+
+  return data.claims
+})

examples/auth/tanstack/lib/supabase/server.ts

@@ -0,0 +1,31 @@
+import { createServerClient } from '@supabase/ssr'
+import { getCookies, setCookie, setResponseHeader } from '@tanstack/react-start/server'
+
+export function createClient() {
+  return createServerClient(
+    process.env.VITE_SUPABASE_URL!,
+    process.env.VITE_SUPABASE_PUBLISHABLE_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return Object.entries(getCookies()).map(
+            ([name, value]) =>
+              ({
+                name,
+                value,
+              }) as { name: string; value: string }
+          )
+        },
+        setAll(cookies, headers) {
+          cookies.forEach(({ name, value, options }) => {
+            setCookie(name, value, options)
+          })
+
+          Object.entries(headers).forEach(([name, value]) => {
+            setResponseHeader(name, value)
+          })
+        },
+      },
+    }
+  )
+}

examples/auth/tanstack/routes/_protected.tsx

@@ -0,0 +1,17 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+import { fetchClaims } from '@/lib/supabase/fetch-claims-server-fn'
+
+export const Route = createFileRoute('/_protected')({
+  beforeLoad: async () => {
+    const claims = await fetchClaims()
+
+    if (!claims) {
+      throw redirect({ to: '/login' })
+    }
+
+    return {
+      claims,
+    }
+  },
+})