fix: remove middleware redirect, let login page handle auth check

src/app/login/page.tsx

@@ -1,14 +1,29 @@
 'use client';
 
-import { useState } from 'react';
+import { useState, useEffect } from 'react';
 import { useRouter } from 'next/navigation';
 
 export default function LoginPage() {
   const [username, setUsername] = useState('');
   const [password, setPassword] = useState('');
   const [error, setError] = useState<string | null>(null);
+  const [checking, setChecking] = useState(true);
   const router = useRouter();
 
+  // Check if already logged in
+  useEffect(() => {
+    fetch('/api/auth/me', { credentials: 'include' })
+      .then(r => r.json())
+      .then(data => {
+        if (data.authenticated) {
+          router.push(data.role === 'admin' ? '/admin' : '/user');
+        } else {
+          setChecking(false);
+        }
+      })
+      .catch(() => setChecking(false));
+  }, [router]);
+
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
     setError(null);
@@ -30,6 +45,17 @@ export default function LoginPage() {
     router.push(data.role === 'admin' ? '/admin' : '/user');
   };
 
+  if (checking) {
+    return (
+      <main style={{ minHeight: '100vh', display: 'flex', alignItems: 'center', justifyContent: 'center', background: '#FAF7F0' }}>
+        <div style={{ textAlign: 'center' }}>
+          <div style={{ fontSize: '32px', marginBottom: '16px' }}>⏳</div>
+          <div style={{ fontSize: '16px', color: '#555' }}>Checking authentication...</div>
+        </div>
+      </main>
+    );
+  }
+
   const accent = '#E8A849';
   const navy = '#010D1E';
   const cream = '#f5f0e8';

src/middleware.ts

@@ -1,21 +1,10 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
-// Simple middleware for Next.js Edge Runtime
-// This is a basic implementation that doesn't verify tokens
-// In a production environment, you would want to verify the token
+// Middleware runs on edge runtime - we can't verify JWT here easily
+// Let the pages handle auth checks via /api/auth/me
 export function middleware(request: NextRequest) {
-  const { pathname } = request.nextUrl;
-  const token = request.cookies.get('session')?.value;
-  
-  // Protect admin routes - let page handle auth UI
-  // No redirect here; the admin page shows login prompt if not authenticated
-  
-  // If logged in and trying to access login, redirect to admin
-  if (pathname === '/login' && token) {
-    return NextResponse.redirect(new URL('/admin', request.url));
-  }
-  
+  // No redirects - login and admin pages handle their own auth UI
   return NextResponse.next();
 }