feat(middleware): carve out /intake/:path* from auth redirect

Phase 8a Task 6. The matcher's exclusion is unchanged; this is the
explicit short-circuit so a future matcher edit cannot accidentally
lock the public route out.

src/middleware.ts

@@ -15,6 +15,14 @@ import { AUTH_COOKIE } from "@/lib/auth/cookie";
 export function middleware(request: NextRequest) {
   const hasAuth = request.cookies.has(AUTH_COOKIE);
 
+  // Public intake links have no session. The token IS the authentication,
+  // and the route's own checks enforce it. A redirect here would lock every
+  // visitor out of the wizard, so /intake/:path* is the one path the
+  // cookie check is allowed to ignore.
+  if (request.nextUrl.pathname.startsWith("/intake/")) {
+    return NextResponse.next();
+  }
+
   if (!hasAuth) {
     const url = request.nextUrl.clone();
     url.pathname = "/login";