fix: isolate proxy session decoding

src/lib/proxy-auth.ts

@@ -0,0 +1,10 @@
+import NextAuth from "next-auth";
+
+// Proxy authentication must only decode the Auth.js session. Importing the
+// full CMS auth configuration here would also run Prisma/settings callbacks.
+export const { auth: proxyAuth } = NextAuth({
+  trustHost: true,
+  secret: process.env.AUTH_SECRET,
+  session: { strategy: "jwt" },
+  providers: [],
+});