fix: use base64url (not base64) for session token verification in middleware

The login route encodes the payload with base64url but the middleware was
decoding with base64 — mismatch caused session verification to always fail,
making protected APIs return 401 even after successful login.

src/middleware.ts

@@ -47,10 +47,11 @@ async function verifySession(token: string | undefined): Promise<boolean> {
   const adminPassword = process.env.ADMIN_PASSWORD
   if (!adminPassword) return false
   try {
-    // Session token format: base64(payload).hmac
+    // Session token format: base64url(payload).hmac
     const [payloadB64, signature] = token.split('.')
     if (!payloadB64 || !signature) return false
-    const payload = JSON.parse(Buffer.from(payloadB64, 'base64').toString())
+    // Use base64url to match the encoding in the login route
+    const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString())
     if (payload.exp && Date.now() > payload.exp) return false
     // Verify HMAC
     const crypto = await import('crypto')