36a34181c9
The real cause of the failed 584MB album upload: Next.js caps the request body at 10MB for any route that passes through middleware, and the import route went through the auth gate. Exclude /api/library/import from the middleware matcher so the body streams uncapped to busboy, and authenticate it inline instead (new lib/auth.isAuthed reads + verifies the session cookie from the request). web 161 tests, tsc + build clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>