Redesign marketing pages and isolate public routes from app auth.

Give the landing, legal, and sign-in flows a consistent product shell while keeping marketing pages free of tRPC/session calls, fixing dev auth URL handling, and refreshing env and deploy docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/lib/public-routes.ts

@@ -0,0 +1,21 @@
+/** Routes that do not require authentication or server session lookups. */
+export const PUBLIC_ROUTES = [
+  "/",
+  "/auth/signin",
+  "/auth/register",
+  "/auth/forgot-password",
+  "/auth/reset-password",
+  "/privacy",
+  "/terms",
+] as const;
+
+/** Path prefixes treated as public (e.g. shareable invoice links). */
+export const PUBLIC_ROUTE_PREFIXES = ["/i/"] as const;
+
+export function isPublicRoute(pathname: string): boolean {
+  if ((PUBLIC_ROUTES as readonly string[]).includes(pathname)) {
+    return true;
+  }
+
+  return PUBLIC_ROUTE_PREFIXES.some((prefix) => pathname.startsWith(prefix));
+}