fix(auth): protect /settings route with middleware and update matcher (#515) - #529

Summary

Closes #515.

Ensures the /settings route is properly guarded at the Edge middleware level, preventing unauthenticated access or UI flash before client-side session checks complete.

Changes Made

• Added "/settings" to PROTECTED_PREFIXES in src/middleware.ts.
• Added "/settings/:path*" to the matcher configuration array in src/middleware.ts.
• Updated unit tests in src/middleware.test.ts verifying that unauthenticated visits to /settings redirect to /connect?redirect=/settings, authenticated visits pass through, and the route matcher covers /settings/:path*.

Acceptance Criteria

• Add /settings to PROTECTED_PREFIXES
• Add /settings/:path* to the matcher array
• Unauthenticated users visiting /settings are redirected to /connect?redirect=/settings
• Authenticated users can access /settings normally