fix: restore session before auth middleware in SPA mode

[zlotnika]

Summary

In SPA mode (useSsrCookies: false), there's a race condition where the auth-redirect middleware checks
useSupabaseSession() before the session is hydrated from localStorage. This causes authenticated users to be incorrectly
redirected to the login page on direct navigation or page reload.

The Problem

1. User is authenticated with a valid session in localStorage
2. User navigates directly to a protected route (or reloads the page)
3. The auth-redirect middleware runs and checks useSupabaseSession().value
4. Session state is still null because onAuthStateChange hasn't fired yet
5. User gets redirected to /login
6. onAuthStateChange fires with the valid session
7. Login page detects session and redirects back

This creates a flash/redirect loop that degrades UX and can break deep linking.

The Fix

Explicitly call getSession() and populate the session state before the plugin setup completes. This ensures the session is
available when middleware runs.

The fix only applies when useSsrCookies is false (SPA mode), since SSR mode uses cookies which are available synchronously.

Test Plan

• Tested with ssr: false and useSsrCookies: false configuration
• Direct navigation to protected routes works without redirect flash
• Page reload maintains authentication state
• Logout still works correctly
• Login flow still works correctly

Fixes #496

🤖 Generated with Claude Code

[vercel]

@zlotnika is attempting to deploy a commit to the NuxtLabs Team on Vercel.

A member of the Team first needs to authorize it.

[zlotnika]

Not sure if this is the best value to check.

[pkg-pr-new]

npm i https://pkg.pr.new/@nuxtjs/supabase@571

commit: a0c41ee

[Shooteger]

@larbish

[larbish]

Thanks @zlotnika, can you please remove the dist folder from your PR? 🙏

[XStarlink]

@larbish @zlotnika Hello I’m linking this issue for additional context about the same problem:
#565

The session is not yet initialized in the plugin when the middleware runs its check. The session only gets set afterward, inside the page:start hook, which executes after the middleware.

As a result, the middleware runs before the session is available, leading to the issue described above.

[zlotnika]

Alright, sorry for forgetting this for so long. @larbish I've removed dist. Let me know if you want anything else!