优化 Vercel Fluid CPU：API加CDN缓存、缩小middleware范围、跳过公共API的Supabase身份转发

- 7条GET路由加 s-maxage + stale-while-revalidate，fetch 改为 next revalidate
- middleware matcher 从全匹配缩小到9条需auth的路径，移除 isStaticAsset
- 8条公共API路由加 includeSupabaseIdentity: false
- backend-auth getSession 为空时跳过 getUser
- subscription-help 加 I18nProvider，移除 force-dynamic → 静态预渲染
- next.config.mjs 加静态资源 immutable 缓存头

Tested: npx tsc --noEmit 通过，npm run build 通过

frontend/lib/backend-auth.ts

@@ -41,17 +41,21 @@ export async function buildBackendRequestHeaders(
   const incomingAuth = extractBearerToken(request.headers.get("authorization"));
   const includeSupabaseIdentity = options?.includeSupabaseIdentity !== false;
   if (hasSupabaseServerEnv() && includeSupabaseIdentity) {
-    const passthroughResponse = new NextResponse(null, { status: 200 });
-    const supabase = createSupabaseRouteClient(request, passthroughResponse);
+    const supabase = createSupabaseRouteClient(request, new NextResponse(null, { status: 200 }));
     const {
       data: { session },
     } = await supabase.auth.getSession();
-    const {
-      data: { user },
-    } = await supabase.auth.getUser();
+    let user = session?.user ?? null;
+    if (session) {
+      const {
+        data: { user: validated },
+      } = await supabase.auth.getUser();
+      user = validated ?? session.user;
+    }
 
-    const forwardedUserId = String(user?.id || session?.user?.id || "").trim();
-    const forwardedEmail = String(user?.email || session?.user?.email || "").trim();
+    const passthroughResponse = new NextResponse(null, { status: 200 });
+    const forwardedUserId = String(user?.id || "").trim();
+    const forwardedEmail = String(user?.email || "").trim();
     if (forwardedUserId) {
       headers.set(FORWARDED_SUPABASE_USER_ID_HEADER, forwardedUserId);
     }