fix: isolate proxy session decoding

src/lib/proxy-auth-contract.test.ts

@@ -0,0 +1,13 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+describe("proxy authentication boundary", () => {
+  it("uses a database-free Auth.js decoder", () => {
+    const proxy = readFileSync("src/proxy.ts", "utf8");
+    const proxyAuth = readFileSync("src/lib/proxy-auth.ts", "utf8");
+
+    expect(proxy).toContain('from "@/lib/proxy-auth"');
+    expect(proxy).not.toContain('from "@/lib/auth"');
+    expect(proxyAuth).not.toMatch(/from\s+["'][^"']*(prisma|site-settings|credentials)[^"']*["']/i);
+  });
+});