fix: restore login by dropping broken Supabase Kong rewrite

Middleware getUser() could not validate the session cookie via the
internal Docker hostname, so auth succeeded in the browser but kept
redirecting back to /login stuck on "Verificando".

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/login/page.tsx

@@ -2,12 +2,11 @@
 
 import React, { useState, Suspense } from 'react';
 import Image from 'next/image';
-import { useRouter, useSearchParams } from 'next/navigation';
+import { useSearchParams } from 'next/navigation';
 import { createClient } from '@/lib/supabase/client';
 import { Mail, Lock, Eye, EyeOff, ShieldCheck, ArrowRight, Loader2 } from 'lucide-react';
 
 function LoginForm() {
-  const router = useRouter();
   const searchParams = useSearchParams();
   const next = searchParams.get('next') || '/dashboard/kpis';
 
@@ -36,9 +35,15 @@ function LoginForm() {
       }
 
       if (data.session) {
-        router.push(next);
+        // Hard navigation so middleware always sees the fresh auth cookie.
-        router.refresh();
+        const dest =
+          next.startsWith('/') && !next.startsWith('//') ? next : '/dashboard/kpis';
+        window.location.assign(dest);
+        return;
       }
+
+      setErrorMsg('No se pudo crear la sesión. Inténtalo de nuevo.');
+      setLoading(false);
     } catch (err: any) {
       setErrorMsg(
         err?.message || 'Error de conexión con el servidor de autenticación.'

src/lib/supabase/server.ts

@@ -7,22 +7,6 @@ export async function createClient() {
     process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
     {
-      global: {
-        fetch: (url: string | URL | Request, options?: RequestInit) => {
-          const u = new URL(url.toString());
-          if (process.env.NODE_ENV === 'production' && u.hostname === 'supabase.4ventures.es') {
-            u.protocol = 'http:';
-            u.hostname = 'ventures-web-supabase-gm0nnn-supabase-kong';
-            u.port = '8000';
-            if (!options) options = {};
-            if (!options.headers) options.headers = new Headers();
-            const headers = new Headers(options.headers);
-            headers.set('Host', 'supabase.4ventures.es');
-            options.headers = headers;
-          }
-          return fetch(u.toString(), options);
-        }
-      },
       cookies: {
         getAll() {
           return cookieStore.getAll();

src/middleware.ts

@@ -1,11 +1,13 @@
 import { createServerClient } from '@supabase/ssr';
 import { NextRequest, NextResponse } from 'next/server';
 
-function withSecurityHeaders(res: NextResponse) {
+function withSecurityHeaders(res: NextResponse, path?: string) {
   res.headers.set('X-Frame-Options', 'DENY');
   res.headers.set('X-Content-Type-Options', 'nosniff');
   res.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+  if (!path?.startsWith('/legal')) {
     res.headers.set('X-Robots-Tag', 'noindex, nofollow');
+  }
   res.headers.set(
     'Permissions-Policy',
     'camera=(), microphone=(), geolocation=()'
@@ -24,26 +26,12 @@ export async function middleware(req: NextRequest) {
     request: { headers: req.headers },
   });
 
+  // Public Supabase URL only — Docker-internal Kong rewrite made getUser() fail
+  // after login (cookie set, middleware treats user as logged out → stuck verifying).
   const supabase = createServerClient(
     process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
     {
-      global: {
-        fetch: (url: string | URL | Request, options?: RequestInit) => {
-          const u = new URL(url.toString());
-          if (process.env.NODE_ENV === 'production' && u.hostname === 'supabase.4ventures.es') {
-            u.protocol = 'http:';
-            u.hostname = 'ventures-web-supabase-gm0nnn-supabase-kong';
-            u.port = '8000';
-            if (!options) options = {};
-            if (!options.headers) options.headers = new Headers();
-            const headers = new Headers(options.headers);
-            headers.set('Host', 'supabase.4ventures.es');
-            options.headers = headers;
-          }
-          return fetch(u.toString(), options);
-        }
-      },
       cookies: {
         getAll() {
           return req.cookies.getAll();