Lightweight CRM template for Lovable

The build prompt

# Context
Build a lightweight shared CRM for a small sales team, typically a founder doing their own sales, tracking companies, people and what was said. Speed of entry matters most, so common actions work from the keyboard.

## Core Features (Priority Order)
1. Contact list from contacts, searched instantly over loaded rows by full_name, email and company, with a server query on full_name and email beyond the loaded page
2. Contact detail with a note timeline from notes, newest first
3. Add a note in two keystrokes (N, then Cmd+Enter), no modal
4. Companies from companies, listing contacts through contacts.company_id
5. Stage from pipeline_stage (new, contacted, qualified, proposal, won, lost), changed inline by the record's owner
6. Owner shown on every record

## Visual Style & Design
- Minimal and focused: dense list, roomy detail, keyboard hints
- Split screen: contact list on the left, detail on the right; below md the list becomes cards
- Geist for headings, Inter for body text
- Colours: background #ffffff, text #111827, muted #6b7280, accent #7c3aed; one colour per stage, identical in list and detail
- shadcn/ui Table, Command for search, Badge for stage, Avatar, Textarea for notes, Select for stage
- Save these style keywords to the project knowledge.

## Signed In and Signed Out
Signed-out visitors see sign-in only. Signed-in users see the whole team's records, with edit controls only on records they own.

## States
- Empty: distinct messages for no contacts ("Add your first contact"), no search results and no notes
- Loading: Skeleton rows in list and timeline
- Error: a stage change updates optimistically and reverts with a toast; a failed note keeps its text with retry

## Data & Access
- Tables companies, contacts and notes, the pipeline_stage type, the touch_updated_at trigger and every row-level security policy already exist in the connected Supabase project from schema.sql. Never weaken, drop or bypass them or create tables; if something is missing, stop and ask me.
- Every signed-in user reads every record; only the owner updates or deletes a company or contact, only the author a note.
- The client never sends owner_id or author_id; defaults set them from auth.uid().

## Done When
- A contact created without an owner field shows the signed-in user as owner
- Signed in as a second account, the first account's contacts are visible with stage and edit controls disabled, and a forced stage update changes zero rows
- A forced update setting owner_id on another user's contact changes zero rows
- A note saves with the signed-in user as author and appears at the top of the timeline
- Signed out, /contacts redirects to sign-in

## Build Order
Sign-in and the contact list, detail and timeline, note creation with its failure path, companies, the inline stage change last.

## Safe-Guard Instructions
- Notes stay append-only in the UI: no edit, bulk delete or reassignment controls
- Ask me before opening sign-up beyond the team, because every signed-in account reads every record
- No service role key in client code

## Before Building
Ask me any questions you need in order to fully understand what I want from this feature and how I envision it. Save my answers to the project knowledge so later prompts build on them.

Companies, contacts, notes and policies

-- Lightweight CRM schema for Lovable + Supabase
-- Reviewed row-level security. Read the comments before running this.
--
-- Model choice worth understanding: this is a SHARED team CRM. Every authenticated user can
-- read every record, because a sales team that cannot see each other's pipeline is not
-- useful. Writes are restricted to the owner. If you need per-user isolation instead, change
-- the select policies to owner_id = auth.uid() and re-run the verification queries.

create type public.pipeline_stage as enum
  ('new', 'contacted', 'qualified', 'proposal', 'won', 'lost');

create table public.companies (

Policy verification queries

-- Verification queries. Run these as user A, then sign in as user B and repeat 3 and 4.

-- 1. Should return the whole team's contacts. This schema is deliberately shared.
select id, full_name, stage, owner_id from public.contacts limit 20;

-- 2. Should SUCCEED, and owner_id should default to you without being supplied.
insert into public.contacts (full_name, email) values ('Verify Person', 'v@example.com');
select full_name, owner_id = auth.uid() as owned_by_me
from public.contacts where email = 'v@example.com';

-- As user B, against a contact owned by user A: