feat(dashboard): GDPR deletion banner + CORS-safe route loaders

- Frozen account banner for pending deletion requests
- deletionPending in session data from OIDC claims
- Route loaders use proxy for client-side fetches (fixes CORS)

Author: docimin

src/components/layout/dashboard-shell.tsx

@@ -14,6 +14,19 @@ export function DashboardShell({ session, services, children }: Props) {
 		<div className="min-h-screen flex">
 			<DynamicSidebar session={session} services={services} />
 			<main className="flex-1 overflow-y-auto">
+				{session.user.deletionPending && (
+					<div className="bg-amber-50 border-b border-amber-200 px-8 py-3 text-sm text-amber-800 dark:bg-amber-950 dark:border-amber-800 dark:text-amber-200">
+						Your account is scheduled for deletion. You can cancel this request
+						in{" "}
+						<a
+							href="/my-account/data-deletion"
+							className="font-medium underline hover:no-underline"
+						>
+							My Account &rarr; Data &amp; Privacy
+						</a>
+						.
+					</div>
+				)}
 				<div className="mx-auto max-w-6xl px-8 py-8">{children}</div>
 			</main>
 		</div>

src/lib/auth.ts

@@ -98,6 +98,7 @@ export interface SessionData {
 		email: string;
 		image?: string;
 		role: string;
+		deletionPending?: boolean;
 	};
 }
 
@@ -187,6 +188,7 @@ export async function fetchUserInfo(
 		email: data.email ?? "",
 		image: data.picture && data.picture !== "—" ? data.picture : undefined,
 		role: data.role ?? "user",
+		deletionPending: data.deletionPending ?? false,
 	};
 }
 

src/routes/_authenticated/$service/$.tsx

@@ -30,11 +30,15 @@ export const Route = createFileRoute("/_authenticated/$service/$")({
 				}
 				const endpoint = interpolateEndpoint(section.endpoint, pathParams);
 				try {
-					const response = await fetch(`${service.baseUrl}${endpoint}`, {
-						headers: {
-							Authorization: `Bearer ${ctx.session.accessToken}`,
-						},
-					});
+					const isServer = typeof window === "undefined";
+					const url = isServer
+						? `${service.baseUrl}${endpoint}`
+						: `/api/proxy/${service.slug}${endpoint}`;
+					const headers: Record<string, string> = {};
+					if (isServer) {
+						headers.Authorization = `Bearer ${ctx.session.accessToken}`;
+					}
+					const response = await fetch(url, { headers });
 					if (!response.ok) return null;
 					return response.json();
 				} catch {

src/routes/_authenticated/$service/index.tsx

@@ -30,11 +30,15 @@ export const Route = createFileRoute("/_authenticated/$service/")({
 				}
 				const endpoint = interpolateEndpoint(section.endpoint, {});
 				try {
-					const response = await fetch(`${service.baseUrl}${endpoint}`, {
-						headers: {
-							Authorization: `Bearer ${ctx.session.accessToken}`,
-						},
-					});
+					const isServer = typeof window === "undefined";
+					const url = isServer
+						? `${service.baseUrl}${endpoint}`
+						: `/api/proxy/${service.slug}${endpoint}`;
+					const headers: Record<string, string> = {};
+					if (isServer) {
+						headers.Authorization = `Bearer ${ctx.session.accessToken}`;
+					}
+					const response = await fetch(url, { headers });
 					if (!response.ok) return null;
 					return response.json();
 				} catch {