fix(frontend): bypass Postiz proxy guard for Hanzo Social routes

The Next proxy (middleware) 307-redirected every non-/auth path without an
'auth' cookie to /auth, intercepting the (social) group's `/` and all /hz/*
routes so the dashboard never rendered and /hz/auth/* + /hz/bff/* were guarded.
Bypass '/' and '/hz/*' early (Postiz behavior for its own paths untouched).
frontend 1.0.1 -> 1.0.2.

apps/frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-frontend",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "",
   "type": "module",
   "scripts": {

apps/frontend/src/proxy.ts

@@ -39,6 +39,14 @@ export async function proxy(request: NextRequest) {
     topResponse.headers.set(cookieName, lng);
   }
 
+  // Hanzo Social: the (social) route group owns "/" and every /hz/* route (its
+  // own hanzo.id OIDC auth + the BFF proxy). The retired Postiz auth guard below
+  // must NOT intercept them — otherwise the dashboard never renders and
+  // /hz/auth/* + /hz/bff/* get 307'd to /auth. Bypass early, keeping i18n headers.
+  if (nextUrl.pathname === '/' || nextUrl.pathname.startsWith('/hz/')) {
+    return topResponse;
+  }
+
   if (nextUrl.pathname.startsWith('/modal/') && !authCookie) {
     return NextResponse.redirect(new URL(`/auth/login-required`, nextUrl.href));
   }