enforce @cornell.edu domain at auth boundaries

[Arsh-S]

• Backend authenticate middleware: returns 403 for JWTs whose email is not @cornell.edu; authenticateOptional silently drops them
• Frontend /auth/callback: validates email domain after exchangeCodeForSession and on existing-user path; calls signOut() and clears sb-* cookies on the redirect response when domain check fails
• New /auth/auth-code-error page with Cornell-only messaging and link back to landing

http://localhost:8080/auth/auth-code-error?reason=non_cornell

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
curaise	Ready	Preview, Comment	Apr 26, 2026 6:01pm

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}