fix(admin): RLS 재귀 수정 + OAuth 쿠키 + 코드 정리

- RLS: profiles 재귀 참조 → app_metadata 기반으로 교체
- auth callback: 쿠키를 response에 직접 설정 (세션 유지)
- middleware: Supabase 세션 갱신 추가
- layout: requireAdmin() 사용으로 통합 (중복 제거)
- admin-guard: app_metadata.role 기반 (JWT, DB 쿼리 불필요)
- debug 라우트 제거
- config.toml: localhost:3000/3001 redirect URL 추가

apps/admin/src/app/(admin)/layout.tsx

@@ -1,5 +1,5 @@
 // apps/admin/src/app/(admin)/layout.tsx
-// Admin 인증 가드 + Sidebar 레이아웃
+// Admin 레이아웃 — requireAdmin() 가드 + Sidebar
 
 import { Box } from '@mui/material'
 import { requireAdmin } from '@/lib/admin-guard'

apps/admin/src/app/auth/callback/route.ts

@@ -1,42 +1,46 @@
 // apps/admin/src/app/auth/callback/route.ts
-// OAuth 콜백 핸들러
+// OAuth 콜백 — code를 session으로 교환
 
 import { NextResponse, type NextRequest } from 'next/server'
 import { createServerClient, type CookieOptions } from '@supabase/ssr'
-import type { Database } from '@d3ro/api-client'
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
   const { searchParams, origin } = new URL(request.url)
   const code = searchParams.get('code')
 
-  if (code) {
-    const supabase = createServerClient<Database>(
-      process.env.NEXT_PUBLIC_SUPABASE_URL ?? '',
-      process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ?? '',
-      {
-        cookies: {
-          getAll() {
-            return request.cookies.getAll()
-          },
-          setAll(cookiesToSet: Array<{ name: string; value: string; options: CookieOptions }>) {
-            cookiesToSet.forEach(({ name, value, options }) => {
-              request.cookies.set({ name, value, ...options })
-            })
-          },
-        },
-      }
-    )
-
-    const { error } = await supabase.auth.exchangeCodeForSession(code)
-    if (!error) {
-      const response = NextResponse.redirect(`${origin}/`)
-      // 세션 쿠키를 응답에 복사
-      request.cookies.getAll().forEach((cookie) => {
-        response.cookies.set(cookie.name, cookie.value)
-      })
-      return response
-    }
+  if (!code) {
+    return NextResponse.redirect(`${origin}/login?error=no_code`)
   }
 
-  return NextResponse.redirect(`${origin}/login`)
+  // 쿠키를 수집할 배열
+  const cookiesToSet: Array<{ name: string; value: string; options: CookieOptions }> = []
+
+  const supabase = createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL ?? '',
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ?? '',
+    {
+      cookies: {
+        getAll() {
+          return request.cookies.getAll()
+        },
+        setAll(cookies) {
+          cookiesToSet.push(...cookies)
+        },
+      },
+    }
+  )
+
+  const { error } = await supabase.auth.exchangeCodeForSession(code)
+
+  if (error) {
+    return NextResponse.redirect(`${origin}/login?error=${encodeURIComponent(error.message)}`)
+  }
+
+  // 세션 교환 성공 후 response 생성 + 수집된 쿠키 적용
+  const response = NextResponse.redirect(`${origin}/`)
+  for (const { name, value, options } of cookiesToSet) {
+    response.cookies.set({ name, value, ...options })
+  }
+
+  return response
 }