fix(frontend): allow mock=true demo URLs through workspace auth guard

[64johnlee]

Problem

Closes #3000

Public Case Studies landing page links to mock demo chat URLs such as:

/workspace/chats/7cfa5f8f-a2f8-47ad-acbd-da7137baf990?mock=true

The workspace/layout.tsx server component runs a full auth check for every /workspace/* route and redirects unauthenticated visitors to /login before the page can read ?mock=true. This makes the public demos completely unreachable for anonymous users.

Root Cause

Next.js App Router layouts receive children and params but not searchParams, so the layout cannot read ?mock=true directly to skip the auth redirect.

Fix

Two small files changed:

src/middleware.ts (new) — Next.js middleware that runs before the layout. When ?mock=true is present, it clones the request headers and injects x-mock: true, which server components can read via headers() from next/headers.

src/app/workspace/layout.tsx — Added an early-return path before getServerSideUser():

const headersList = await headers();
if (headersList.get("x-mock") === "true") {
  return <WorkspaceContent>{children}</WorkspaceContent>;
}

The chat page already handles mock mode via useThreadChat().isMock (switching to the read-only mock API client). This change simply lets the request reach the page.

Validation

• pnpm typecheck — clean
• pnpm lint — clean
• Normal authenticated workspace routes are completely unaffected (middleware is a no-op when mock param is absent)