Self-host login bounces back to /login: NextAuth cookie-name mismatch

After email login on a self-host HTTPS instance, every page bounces back to /login even though the session is valid (/api/auth/session returns the user). The middleware and the NextAuth route handler disagree on the session cookie name.

• Route handler writes next-auth.session-token — the bundled cookies config keys the __Secure- prefix on VERCEL_URL, which isn't set on a plain self-host.
• Middleware's getToken keys the prefix on NEXTAUTH_URL.startsWith("https://"), which is true behind TLS, so it reads __Secure-next-auth.session-token — which was never written.

getToken → null → redirect to /login. Writer and reader use two independent derivations (VERCEL_URL vs NEXTAUTH_URL/VERCEL) that can disagree.

Repro: self-host behind HTTPS nginx → plain-HTTP container, NEXTAUTH_URL=https://…, no VERCEL_URL. Complete email login; /api/auth/session shows the user but / is 307 → /login. Same story matches #1353.

Fix: derive useSecureCookies once and use it for both the cookie name in the route handler and getToken({ secureCookie }) in the middleware, so they can't disagree.

Workaround:

FROM ghcr.io/avnox-com/papermark:latest
RUN sed -i 's|cookieName:o=a?"__Secure-next-auth.session-token":"next-auth.session-token"|cookieName:o="next-auth.session-token"|' /app/.next/server/middleware.js

After patching, /documents and /dashboard return 200 with the existing session cookie.

ghcr.io/avnox-com/papermark:latest, Next.js 14.2.35.