Signed-in session silently acts as a guest instead of ending

Problem

The sidebar can show you as signed in (name, avatar) while every backend call goes out as a guest. Seen by Rían in Paradaux: the switcher listed only Paradaux (the one public workspace), and the member-only links (Triage, Analytics, Archive) were missing. In the database Rían owns Paradaux, Private and Taskl.ie.

A session that can no longer prove who you are should end and drop you to the signed-out state. It shouldn't linger as a guest that looks signed in.

Cause

• Nothing ever rewrites the Auth.js session cookie after login. There is no middleware and no SessionProvider, and auth() in a server component cannot set cookies. Every render after the first 5 minutes refreshes from the login-time refresh token, and the result is thrown away. getViewer and getActorToken call auth() separately, so that's two or more Keycloak round trips per render, each of which can fail on its own.
• When a refresh fails without a 4xx (network error, 5xx), session-refresh.ts keeps the session but drops the access token. getViewer still returns the person, getActorToken returns null, and the backend sees a guest.
• Because the cookie is frozen, the login refresh token is never replaced. When it lapses (SSO idle or max lifespan), Keycloak rejects it on every render, even if you were active.

Fix

1. Add middleware.ts (Node runtime) that runs the Auth.js session check once per request. It saves the refreshed cookie on the response and passes it on to this request's render. A rejected refresh clears the cookie, so you're properly signed out.
2. getViewer returns null when the session has no access token, so "signed in but tokenless" can't render as signed in.
3. Unit tests for the cookie forwarding and the viewer rule.

Acceptance

• After an access token expires, the next request saves a fresh token in the cookie. Renders no longer refresh on their own.
• A revoked or expired Keycloak session ends the web session: guest UI with a sign-in prompt, and protected pages redirect to /login.
• A transient refresh failure never shows a signed-in shell running as a guest.