fix: add middleware to bypass auth for payment callback routes

DuluPay payment callbacks were returning 307 redirect to login page
because the server-to-server requests have no session cookie. This
caused all payment notifications to fail, preventing points from
being credited after successful payment.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

middleware.ts

@@ -0,0 +1,17 @@
+import { NextRequest, NextResponse } from "next/server";
+
+/**
+ * Middleware to ensure payment callback paths are never blocked by auth.
+ *
+ * DuluPay sends server-to-server GET/POST callbacks without any session
+ * cookie.  Without this middleware, the request may be intercepted and
+ * redirected to the login page (HTTP 307), causing payment notifications
+ * to fail silently and points never being credited.
+ */
+export function middleware(_request: NextRequest) {
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ["/api/payment/:path*"],
+};