fix #12: middleware __Secure- cookie prefix check

Middleware only checked for better-auth.session_token but HTTPS uses
__Secure-better-auth.session_token, causing all protected routes to
redirect to sign-in even when authenticated.

src/middleware.ts

@@ -7,7 +7,10 @@ function hasSessionCookie(headers: Headers): boolean {
   const cookieHeader = headers.get("cookie") ?? "";
   return cookieHeader
     .split(";")
-    .some((c) => c.trim().startsWith("better-auth.session_token="));
+    .some((c) => {
+      const trimmed = c.trim();
+      return trimmed.startsWith("better-auth.session_token=") || trimmed.startsWith("__Secure-better-auth.session_token=");
+    });
 }
 
 export async function middleware(request: NextRequest) {