fix: isolate proxy session decoding

src/proxy.ts

@@ -1,12 +1,12 @@
 import { NextResponse } from "next/server";
-import { auth } from "@/lib/auth";
+import { proxyAuth } from "@/lib/proxy-auth";
 import { shouldRedirectAdminRequest } from "@/lib/proxy-access";
 
 // Edge proxy (formerly "middleware"): Prisma can't run here, so we only forward
 // the request path (so server components / the access guard can read it via
 // headers()) and normalize the real client IP. The DB-backed banned/maintenance
 // checks happen in src/lib/access-guard.ts (Node runtime) from the root layout.
-export const proxy = auth((req) => {
+export const proxy = proxyAuth((req) => {
   if (shouldRedirectAdminRequest(req.nextUrl.pathname, req.auth?.user ?? null)) {
     return NextResponse.redirect(new URL("/login", req.url));
   }