feat: add iOS support and harden receipt scanning

src/app/api/auth/session/route.ts

@@ -7,9 +7,9 @@ export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
 /** Who am I? Returns `{ user: null }` when signed out — never an error. */
-export async function GET() {
+export async function GET(request: Request) {
   try {
-    const user = await getCurrentUser();
+    const user = await getCurrentUser(request);
     if (!user) return NextResponse.json({ user: null });
 
     const isPro = isProActive(user);