feat: implement user account center with authentication, subscription management, and EVM wallet integration.

frontend/components/account/AccountCenter.tsx

@@ -646,6 +646,13 @@ export function AccountCenter() {
     } = await client.auth.refreshSession();
     const refreshedToken = String(refreshed?.access_token || "").trim();
     if (refreshedToken) return refreshedToken;
+    if (
+      cachedToken &&
+      Number.isFinite(expiresAtSec) &&
+      expiresAtSec > nowSec
+    ) {
+      return cachedToken;
+    }
     throw new Error(
       error?.message
         ? isEn

frontend/lib/backend-auth.ts

@@ -51,14 +51,14 @@ export async function buildBackendRequestHeaders(
       headers.set(FORWARDED_SUPABASE_EMAIL_HEADER, forwardedEmail);
     }
 
-    const accessToken = session?.access_token || "";
-    if (accessToken) {
-      // Prefer server-side session token to avoid stale client bearer tokens.
-      headers.set("Authorization", `Bearer ${accessToken}`);
-      return { headers, response: passthroughResponse };
-    }
     if (incomingAuth) {
       headers.set("Authorization", `Bearer ${incomingAuth}`);
+      return { headers, response: passthroughResponse };
+    }
+    const accessToken = session?.access_token || "";
+    if (accessToken) {
+      // Fallback to cookie-backed session when request does not carry bearer.
+      headers.set("Authorization", `Bearer ${accessToken}`);
     }
     return { headers, response: passthroughResponse };
   }

frontend/middleware.ts

@@ -94,6 +94,12 @@ async function handleSupabaseAuthGate(request: NextRequest) {
   if (isPublicPage(pathname)) {
     return NextResponse.next();
   }
+  if (pathname.startsWith("/api/")) {
+    const authHeader = String(request.headers.get("authorization") || "").trim();
+    if (/^bearer\s+\S+/i.test(authHeader)) {
+      return NextResponse.next();
+    }
+  }
 
   const response = NextResponse.next({
     request: {