v0.16.23

What's fixed

• Kept the app proxy/middleware from calling Supabase auth on unprotected API routes, preventing route-wide MIDDLEWARE_INVOCATION_TIMEOUT 504s when auth/network calls stall before API handlers run.
• Added proxy regression tests proving unprotected API routes bypass updateSession while protected app routes and sign-in redirects still use auth.