Phase 2

Base app architecture:

    Route groups for customer, staff and owner.
* Reusable design system with around 20 UI components.
* Complete Prisma schema.
* Authentication with email/password and Google.
* Role and permission model.
* Protected routes.
* Clean separation between features, services, components and shared utilities.

src/proxy.ts

@@ -0,0 +1,30 @@
+import NextAuth from "next-auth";
+import { NextResponse } from "next/server";
+import { authConfig } from "@/auth.config";
+
+const PROTECTED_PREFIXES = ["/home", "/appointments", "/settings", "/staff", "/owner"];
+
+// Lightweight instance built from the DB-free config — see auth.config.ts.
+// Next.js 16 renamed this file convention from `middleware` to `proxy`
+// (https://nextjs.org/docs/messages/middleware-to-proxy); it now always
+// runs on the Node.js runtime rather than Edge, but this stays split from
+// the full `@/auth` regardless, so checking "is there a session" doesn't
+// spin up a Postgres connection pool on every request.
+const { auth } = NextAuth(authConfig);
+
+export default auth((req) => {
+  const { pathname } = req.nextUrl;
+  const isProtected = PROTECTED_PREFIXES.some(
+    (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),
+  );
+
+  if (isProtected && !req.auth) {
+    const signInUrl = new URL("/sign-in", req.nextUrl.origin);
+    signInUrl.searchParams.set("callbackUrl", pathname);
+    return NextResponse.redirect(signInUrl);
+  }
+});
+
+export const config = {
+  matcher: ["/((?!api|_next/static|_next/image|favicon.ico).*)"],
+};