feat(web): Next.js 15 app shell, auth, i18n, base UI

App Router setup with next-intl (en/fr), Better Auth wiring, shadcn/ui components,
Tailwind, AES-256-GCM encrypt util, Redis rate limiter, tier limit checker,
site_settings helper for runtime .env overrides.

apps/web/proxy.ts

@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSessionCookie } from "better-auth/cookies";
+
+const PUBLIC_PATHS = ["/login", "/signup", "/verify-email", "/forgot-password", "/reset-password", "/api/auth", "/r/", "/u/", "/docs", "/api/v1/openapi.json", "/api/webhooks"];
+const ADMIN_PATHS = ["/admin"];
+
+export async function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  const isPublic = PUBLIC_PATHS.some((p) => pathname.startsWith(p));
+  const isAdmin = ADMIN_PATHS.some((p) => pathname.startsWith(p));
+  const isApi = pathname.startsWith("/api/v1");
+
+  if (isPublic) return NextResponse.next();
+
+  const sessionCookie = getSessionCookie(request);
+
+  if (!sessionCookie) {
+    if (isApi) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    return NextResponse.redirect(new URL("/login", request.url));
+  }
+
+  if (isAdmin) {
+    // Role check happens inside admin pages — middleware only checks auth
+    // Full role verification requires DB lookup, done server-side in admin layout
+  }
+
+  return NextResponse.next();
+}
+
+export default proxy;
+
+export const config = {
+  matcher: [
+    "/((?!_next/static|_next/image|favicon.ico|public/).*)",
+  ],
+};