fix: remove conflicting middleware.ts, enhance proxy.ts auth

- Delete middleware.ts (Next.js 16 uses proxy.ts instead)
- Add JWT verification for page routes (not just token existence)
- Protect root / and all app pages (stats, skills, mcp, openbook)
- Clear invalid cookies on expired JWT

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: drhema

src/middleware.ts

@@ -55,12 +55,22 @@ export async function proxy(req: NextRequest) {
     }
   }
 
-  // Protect app pages (redirect to login)
-  if (pathname.startsWith('/chat') || pathname.startsWith('/vibecoder') || pathname.startsWith('/settings')) {
+  // Protect app pages (redirect to login if no valid token)
+  if (pathname === '/' || pathname.startsWith('/chat') || pathname.startsWith('/vibecoder') || pathname.startsWith('/settings') || pathname.startsWith('/stats') || pathname.startsWith('/skills') || pathname.startsWith('/mcp') || pathname.startsWith('/openbook')) {
     const token = req.cookies.get('vibecoder-token')?.value
     if (!token) {
       return NextResponse.redirect(new URL('/login', req.url))
     }
+    // Also verify JWT for pages (not just existence)
+    if (JWT_SECRET) {
+      try {
+        await jwtVerify(token, JWT_SECRET)
+      } catch {
+        const response = NextResponse.redirect(new URL('/login', req.url))
+        response.cookies.delete('vibecoder-token')
+        return response
+      }
+    }
   }
 
   return addSecurityHeaders(NextResponse.next())