fix: remove dead api-types Dockerfile refs, drop duplicate middleware.ts

Dockerfile still COPYed packages/api-types (deleted in the prior audit-fixes
commit), breaking Portainer builds. Also drop apps/web/middleware.ts, added
in the same commit for auth guarding — it duplicated and conflicted with the
pre-existing apps/web/proxy.ts (Next 16's middleware entry point), which
already redirects unauthenticated requests to /login, 401s API routes, and
covers /recipes/new, /explore, /search, /settings/webhooks/docs via its
catch-all matcher. Having both middleware.ts and proxy.ts breaks `next build`
outright. Verified with a local `docker build` end to end.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -8,7 +8,6 @@ WORKDIR /repo
 COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./
 COPY apps/web/package.json apps/web/package.json
 COPY packages/db/package.json packages/db/package.json
-COPY packages/api-types/package.json packages/api-types/package.json
 RUN pnpm install --frozen-lockfile
 
 # ---- migrator: applies drizzle migrations + seeds tier definitions ----
@@ -23,7 +22,6 @@ WORKDIR /repo
 COPY --from=deps /repo/node_modules ./node_modules
 COPY --from=deps /repo/apps/web/node_modules ./apps/web/node_modules
 COPY --from=deps /repo/packages/db/node_modules ./packages/db/node_modules
-COPY --from=deps /repo/packages/api-types/node_modules ./packages/api-types/node_modules
 COPY . .
 # apps/web/.env.local is normally a symlink to repo-root .env.local (gitignored);
 # it doesn't exist in the build context, so Next's env loader chokes on the dangling

apps/web/middleware.ts

@@ -1,37 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { getSessionCookie } from "better-auth/cookies";
-
-// Guards the (app) and admin route groups. This only checks for the
-// presence/validity-shape of the Better Auth session cookie — it does NOT
-// hit the DB. Per-route handlers (and the admin layout) still perform the
-// authoritative session/role checks server-side; this is a fast redirect
-// for the common unauthenticated case.
-export function middleware(request: NextRequest) {
-  const sessionCookie = getSessionCookie(request);
-
-  if (!sessionCookie) {
-    const loginUrl = new URL("/login", request.url);
-    loginUrl.searchParams.set("redirect", request.nextUrl.pathname);
-    return NextResponse.redirect(loginUrl);
-  }
-
-  return NextResponse.next();
-}
-
-export const config = {
-  matcher: [
-    "/recipes/:path*",
-    "/explore",
-    "/search",
-    "/settings/:path*",
-    "/feed",
-    "/pantry",
-    "/messages/:path*",
-    "/shopping-lists/:path*",
-    "/u/:path*",
-    "/people/:path*",
-    "/collections/:path*",
-    "/meal-plan/:path*",
-    "/admin/:path*",
-  ],
-};