Fix invitation flow by allowing unauthenticated tRPC requests

The middleware was blocking /api/trpc requests for unauthenticated users,
which prevented the accept-invite page from calling the public
validateInviteToken procedure. tRPC handles its own authentication
via procedure middleware, so the NextAuth middleware should allow
all tRPC requests through.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/lib/auth.config.ts

@@ -45,6 +45,7 @@ export const authConfig: NextAuthConfig = {
         '/accept-invite',
         '/apply',
         '/api/auth',
+        '/api/trpc', // tRPC handles its own auth via procedures
       ]
 
       // Check if it's a public path