fix: allow DuluPay payment callbacks to bypass auth in proxy.ts

The previous commit incorrectly added middleware.ts which conflicts
with Next.js 16's proxy.ts. The actual auth gate is in proxy.ts which
redirects unauthenticated GET requests to /login. DuluPay's server-to-
server callbacks have no session cookie, so they need to be whitelisted.

Removes middleware.ts and adds /api/payment/* to proxy.ts whitelist.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

middleware.ts

@@ -1,17 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-
-/**
- * Middleware to ensure payment callback paths are never blocked by auth.
- *
- * DuluPay sends server-to-server GET/POST callbacks without any session
- * cookie.  Without this middleware, the request may be intercepted and
- * redirected to the login page (HTTP 307), causing payment notifications
- * to fail silently and points never being credited.
- */
-export function middleware(_request: NextRequest) {
-  return NextResponse.next();
-}
-
-export const config = {
-  matcher: ["/api/payment/:path*"],
-};

proxy.ts

@@ -161,6 +161,11 @@ export async function proxy(request: NextRequest) {
     return NextResponse.next();
   }
 
+  // 允许 DuluPay 支付回调（服务端回调无 session cookie）
+  if (pathname.startsWith("/api/payment/")) {
+    return NextResponse.next();
+  }
+
   // 检测是否为 HTTPS（通过 AUTH_URL 或请求协议判断）
   const isSecure = process.env.AUTH_URL?.startsWith("https://") || 
                    request.nextUrl.protocol === "https:";