fix: patch critical auth and RLS security findings from final review

middleware.ts

@@ -51,6 +51,24 @@ export async function middleware(request: NextRequest) {
     }
   }
 
+  // Role-based route enforcement for protected paths
+  if (user && !isPublicRoute && pathname !== '/') {
+    const { data: profile } = await supabase
+      .from('users')
+      .select('role')
+      .eq('id', user.id)
+      .single()
+
+    const role = profile?.role
+    if (isValidRole(role)) {
+      const allowedPrefix = ROLE_HOME[role as UserRole]
+      // Block access to routes that don't belong to this role
+      if (!pathname.startsWith(allowedPrefix)) {
+        return NextResponse.redirect(new URL(allowedPrefix, request.url))
+      }
+    }
+  }
+
   return supabaseResponse
 }