fix(#464): session-expiry redirect + fix critical publicPaths auth-bypass

[Vyacheslav-Tomashevskiy]

Closes #464.

What

middleware.ts now redirects to /login?expired=1 (instead of a bare /login) when a protected page is hit with a missing session cookie or a token that fails verification. The login page reads that flag, shows "Your session expired. Please log in again.", and strips the query param so a refresh doesn't keep re-showing it (same useSearchParams() + Suspense pattern already used on activity/review).

🔴 Also fixes a critical, currently-live auth-bypass bug found while writing tests for the above

publicPaths included "/", checked via publicPaths.some((p) => pathname.startsWith(p)). Since every pathname starts with "/", that allow-list matched literally every route - /dashboard, /api/transactions, all of it - so the auth gate was a silent no-op. No cookie/token check ever ran for any page or API route.

Verified live with npm run dev on the unpatched code:

GET /dashboard   (no cookie)  -> 200 OK   (should have redirected to /login)

After the fix:

GET /dashboard          (no cookie) -> 307 -> /login?expired=1
GET /api/transactions   (no cookie) -> 401 {"success":false,"error":"Unauthorized"}
GET /                                -> 200 (still public, as intended)
GET /login                           -> 200 (still public, as intended)

Fix: exact-match "/" (pathname === "/"), keep prefix-matching for the genuine directory-style entries (/legal/, /api/public/, /_next/, etc).

Tests

New src/__tests__/middleware.test.ts (none existed before) - 5 tests covering the ?expired=1 redirect on missing/invalid token, valid-session passthrough, plain 401 (no redirect) for API routes, and that /login itself stays public without touching verifyToken. 3 of the 5 would fail again if the publicPaths regression came back, so this also guards the auth-bypass fix, not just the new feature.

npx vitest run: 66/66 relevant tests pass. The 4 suites that fail on a clean origin/main checkout fail at collection time due to a separate, already-reported bug (missing isValidStellarPublicKey import in validations.ts - fix pending in #529, left untouched here to avoid a third PR touching the same lines). npm run build verified to compile clean once that one import is present locally. eslint / tsc --noEmit clean on every file this PR touches.

[vercel]

Someone is attempting to deploy a commit to the codex723's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Vyacheslav-Tomashevskiy]

⚠️ Flagging severity for maintainer triage: this PR includes a fix for what is currently a live, complete authentication bypass on main (every route matches publicPaths because of the "/" prefix-match, so the cookie/token check never runs for any page or API route). If issue #464 itself can wait, the publicPaths half of this diff probably shouldn't - happy to split it into its own PR first if that's easier to review/merge fast.