Auth fix

Implemented
- Root cause fixed in [src/proxy.ts]: Auth.js is now initialized lazily and never invoked when MANAGER_MODE=true.
- Manager requests call handleProxyRequest directly, preserving redirects and CSP.
- Business requests continue through Auth.js with existing protected-route behavior.
- Added coverage in [proxy-manager-mode.test.ts]

src/proxy.ts

@@ -29,13 +29,15 @@ const INSTALL_EXEMPT_PREFIXES = [
   "/sw.js",
 ];
 
-// Lightweight instance built from the DB-free config — see auth.config.ts.
-// Next.js 16 renamed this file convention from `middleware` to `proxy`
-// (https://nextjs.org/docs/messages/middleware-to-proxy); it now always
-// runs on the Node.js runtime rather than Edge, but this stays split from
-// the full `@/auth` regardless, so checking "is there a session" doesn't
-// spin up a Postgres connection pool on every request.
-const { auth } = NextAuth(authConfig);
+// Build the business Auth.js middleware only when a business request needs
+// it. Manager requests must not construct or invoke this wrapper at all.
+type BusinessProxy = (req: NextRequest) => Response | Promise<Response>;
+let authenticatedProxy: BusinessProxy | undefined;
+
+function getAuthenticatedProxy() {
+  authenticatedProxy ??= NextAuth(authConfig).auth as unknown as BusinessProxy;
+  return authenticatedProxy;
+}
 
 /**
  * Nonce-gated 'strict-dynamic' script-src (Next's own documented pattern)
@@ -139,7 +141,10 @@ export async function handleProxyRequest(req: AuthenticatedNextRequest) {
   return response;
 }
 
-export default auth(handleProxyRequest);
+export default function proxy(req: NextRequest) {
+  if (process.env.MANAGER_MODE === "true") return handleProxyRequest(req);
+  return getAuthenticatedProxy()(req);
+}
 
 export const config = {
   matcher: ["/((?!api|_next/static|_next/image|favicon.ico).*)"],