fix: update middleware for custom auth and increase dev rate limit

- Change session cookie name from better-auth.session_token to session_token
- Increase rate limit to 100 req/min in development (10 in production)
- Fix DATABASE_URL to use URL-encoded password for special characters

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docker-compose.yml

@@ -72,7 +72,7 @@ services:
       - web
     environment:
       NODE_ENV: development
-      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/vorteq_dev
+      DATABASE_URL: postgresql://postgres:L9IbAPm7zFFaTdfCgVxDQhK7cKp8%2BwGH1pNp%2Fsz0joA%3D@postgres:5432/vorteq_dev
       REDIS_URL: redis://redis:6379/0
       BETTER_AUTH_SECRET: ${DEV_AUTH_SECRET}
       BETTER_AUTH_URL: https://${DEV_DOMAIN}

src/middleware.ts

@@ -60,8 +60,9 @@ export async function middleware(request: NextRequest) {
       request.headers.get('x-real-ip') ||
       'unknown';
 
-    // 10 requests per minute for auth endpoints
-    if (!checkRateLimit(ip, 10, 60 * 1000)) {
+    // Rate limit: 100 requests per minute in dev, 10 in production
+    const maxRequests = process.env.NODE_ENV === 'development' ? 100 : 10;
+    if (!checkRateLimit(ip, maxRequests, 60 * 1000)) {
       return NextResponse.json(
         {
           error: 'Too many requests. Please try again later.',
@@ -101,8 +102,8 @@ export async function middleware(request: NextRequest) {
   }
 
   // Check authentication for protected routes
-  // Better Auth sets a session cookie - check for its presence
-  const sessionCookie = request.cookies.get('better-auth.session_token');
+  // Custom auth sets a session_token cookie - check for its presence
+  const sessionCookie = request.cookies.get('session_token');
 
   if (!sessionCookie) {
     // Redirect to login if not authenticated