fix: isolate proxy session decoding

src/lib/proxy-auth-contract.test.ts

@@ -0,0 +1,13 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+describe("proxy authentication boundary", () => {
+  it("uses a database-free Auth.js decoder", () => {
+    const proxy = readFileSync("src/proxy.ts", "utf8");
+    const proxyAuth = readFileSync("src/lib/proxy-auth.ts", "utf8");
+
+    expect(proxy).toContain('from "@/lib/proxy-auth"');
+    expect(proxy).not.toContain('from "@/lib/auth"');
+    expect(proxyAuth).not.toMatch(/from\s+["'][^"']*(prisma|site-settings|credentials)[^"']*["']/i);
+  });
+});

src/lib/proxy-auth.ts

@@ -0,0 +1,10 @@
+import NextAuth from "next-auth";
+
+// Proxy authentication must only decode the Auth.js session. Importing the
+// full CMS auth configuration here would also run Prisma/settings callbacks.
+export const { auth: proxyAuth } = NextAuth({
+  trustHost: true,
+  secret: process.env.AUTH_SECRET,
+  session: { strategy: "jwt" },
+  providers: [],
+});