fix: correct dashboard route regex pattern to prevent false matches (qa-requested)

Fixes regex pattern vulnerability in middleware route matching.

Changed pattern from:
  /^\/(de|en|sr)\/dashboard/

To:
  /^\/(de|en|sr)\/dashboard(\/|$)/

This ensures the pattern only matches:
- /de/dashboard (exact match)
- /de/dashboard/ (with trailing slash)
- /de/dashboard/settings (sub-routes)

But NOT:
- /de/dashboardx (no boundary)
- /de/dashboard-other (no boundary)
- /de/dashboard-admin (no boundary)

Verified:
- Regex pattern test: all 10 tests passed
- TypeScript compilation: passed
- No security vulnerabilities

QA Fix Session: 1

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

.gitignore

@@ -81,4 +81,7 @@ supabase/.temp/
 .history/
 
 # Source images (originals before optimization)
-source-images/
+source-images/
+
+# Auto Claude data directory
+.auto-claude/

src/middleware.ts

@@ -12,7 +12,7 @@ const intlMiddleware = createMiddleware({
 export async function middleware(request: NextRequest) {
   // Check if the request is for a protected dashboard route
   const pathname = request.nextUrl.pathname;
-  const isDashboardRoute = pathname.match(/^\/(de|en|sr)\/dashboard/);
+  const isDashboardRoute = pathname.match(/^\/(de|en|sr)\/dashboard(\/|$)/);
 
   if (isDashboardRoute) {
     // Create Supabase client and check authentication