perf(auth): skip getUser() when no auth cookies present

The middleware was calling getUser() on EVERY request including unauthenticated
ones (bots, prefetches, public pages). This caused 13,000+ auth API requests
per hour with zero users, burning through Supabase rate limits.

Now checks for sb-* cookies first — if none exist, returns immediately without
hitting the Supabase Auth API.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

lib/supabase/proxy.ts

@@ -48,10 +48,16 @@ export async function updateSession(request: NextRequest): Promise<{ response: N
   // supabase.auth.getClaims(). A simple mistake could make it very hard to debug
   // issues with users being randomly logged out.
 
-  // IMPORTANT: DO NOT REMOVE auth.getUser()
-  // A simple mistake could make it very hard to debug issues with users being randomly logged out.
-  // Returns the user so callers don't need a second getUser() network call.
+  // IMPORTANT: Only call getUser() when auth cookies exist.
+  // Without this check, every unauthenticated request (bots, prefetches, public pages)
+  // makes a wasted network call to Supabase Auth — causing thousands of unnecessary
+  // requests that burn through rate limits.
   let user: User | null = null
+  const hasAuthCookies = request.cookies.getAll().some(c => c.name.startsWith('sb-'))
+  if (!hasAuthCookies) {
+    return { response: supabaseResponse, user: null }
+  }
+
   try {
     const { data } = await supabase.auth.getUser()
     user = data.user