fix: use getSession in middleware so login works offline of Kong

Edge getUser() could not reach Auth, so a valid cookie still looked
logged-out. Route on the local session cookie instead.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/middleware.ts

@@ -49,9 +49,12 @@ export async function middleware(req: NextRequest) {
     }
   );
 
+  // Prefer local session from cookie. getUser() revalidates via Auth network and
+  // fails in this Edge runtime when Kong/hairpin is broken → endless login loop.
   const {
-    data: { user },
+    data: { session },
-  } = await supabase.auth.getUser();
+  } = await supabase.auth.getSession();
+  const user = session?.user ?? null;
 
   const url = req.nextUrl.clone();
   const path = url.pathname;