refactor: convert to bun workspaces monorepo

- Move web app into apps/web/
- Create packages/shared/ with shared types
- Create plugins/decky-vault/ scaffold
- Root package.json manages workspaces only

apps/web/proxy.ts

@@ -0,0 +1,65 @@
+import { NextResponse } from "next/server"
+import type { NextRequest } from "next/server"
+import { auth } from "@/lib/auth"
+
+const authRoutes = [
+    "/login",
+    "/signup",
+    "/forgot-password",
+    "/reset-password",
+]
+
+const adminRoutes = ["/admin"]
+
+export async function proxy(req: NextRequest) {
+    const path = req.nextUrl.pathname
+    const isAuthRoute = authRoutes.some((route) => path.startsWith(route))
+    const isAdminRoute = adminRoutes.some((route) => path.startsWith(route))
+
+    if (!isAuthRoute && !isAdminRoute) {
+        return NextResponse.next()
+    }
+
+    // Allow authenticated users to complete the signup wizard.
+    // After signUp.email() creates a session, the wizard needs to stay
+    // on /signup to complete OTP verification and passkey setup.
+    if (path === "/signup") {
+        const step = req.nextUrl.searchParams.get("step")
+        if (step === "otp" || step === "passkey") {
+            // Wizard step URLs require a valid session (created by signUp.email() in step 1).
+            // Without a session, redirect to /signup to prevent URL-guessing bypass.
+            const wizardSession = await auth.api.getSession({
+                headers: req.headers,
+            })
+            if (wizardSession) {
+                return NextResponse.next()
+            }
+            return NextResponse.redirect(new URL("/signup", req.url))
+        }
+    }
+
+    // Validate session server-side instead of just checking cookie existence.
+    // This prevents stale cookies from causing redirect loops.
+    const session = await auth.api.getSession({
+        headers: req.headers,
+    })
+
+    // Admin routes: require an admin session
+    if (isAdminRoute) {
+        if (!session || session.user.role !== "admin") {
+            return NextResponse.redirect(new URL("/", req.url))
+        }
+        return NextResponse.next()
+    }
+
+    // Auth routes: redirect authenticated users away
+    if (session) {
+        return NextResponse.redirect(new URL("/", req.url))
+    }
+
+    return NextResponse.next()
+}
+
+export const config = {
+    matcher: ["/((?!api|_next/static|_next/image|.*\\.png$).*)"],
+}