Simplify auth - remove middleware, keep session handling only

Fix auth loop: use TimestampSigner + base64 to match Starlette SessionMiddleware

Update via HuggingFace Tool

Fix auth loop: decode session cookie directly in middleware

Create auth.py