fix(sharing): allowlist /api/shared in middleware

Anonymous callers to the shared mailbox API got 401 because the
middleware matcher's broad page pattern catches /api paths but the
inner allowlist only carved out /api/auth. SSR rendered the mailbox
listing, but every client-side fetch (message detail, polling,
pagination) was rejected, so opening a shared mailbox showed the list
without being able to read any message body.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

middleware.ts

@@ -19,7 +19,10 @@ export async function middleware(request: Request) {
   const pathname = url.pathname
 
   if (pathname.startsWith('/api')) {
-    if (pathname.startsWith('/api/auth')) {
+    if (
+      pathname.startsWith('/api/auth') ||
+      pathname.startsWith('/api/shared')
+    ) {
       return NextResponse.next()
     }