fix: allow unauthenticated access to /login to prevent redirect loop

Unauthenticated requests to /login were hitting the auth gate and
redirecting back to /login?callbackUrl=/login, causing a loop.
Let the login page render for unauthenticated users; only redirect
away from /login when the user is already logged in.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/middleware.ts

@@ -84,11 +84,15 @@ export default auth((req) => {
     if (pathname.startsWith('/api/')) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
-    const loginUrl = siteUrl(req, '/login')
+    if (pathname !== '/login') {
-    loginUrl.searchParams.set('callbackUrl', pathname)
+      const loginUrl = siteUrl(req, '/login')
-    return NextResponse.redirect(loginUrl)
+      loginUrl.searchParams.set('callbackUrl', pathname)
+      return NextResponse.redirect(loginUrl)
+    }
+    return NextResponse.next()
   }
 
+  // Logged-in users hitting /login get sent to the dashboard
   if (pathname === '/login') {
     return NextResponse.redirect(siteUrl(req, '/dashboard'))
   }