Apply tech debt fixes: middleware rename, React.cache, file size limits, remove dead deps

- Rename proxy.ts → middleware.ts, export proxy() → middleware() so Next.js edge
  protection actually activates (F001)
- Add PUBLIC_ROUTES entries for /forgot-password and /reset-password
- Wrap getSettings() in React.cache() to eliminate duplicate DB call in root layout (F003)
- Remove 4 console.log calls from saveLesson Server Action, keep console.error (F005)
- Add 50 MB file size guard to all 6 upload routes before arrayBuffer() read (F004)
- Remove unused deps: @tailwindcss/typography, shadcn, tw-animate-css (F008)
- Update CLAUDE.md: Prisma version 6.x → 7.x
- Add TECH_DEBT_AUDIT.md with 14 findings across 9 dimensions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/settings.ts

@@ -1,3 +1,4 @@
+import { cache } from "react";
 import { prisma } from "./prisma";
 
 // ── Defaults ──────────────────────────────────────────────────────────────────
@@ -52,7 +53,7 @@ export type Settings = Record<SettingsKey, string>;
 
 // ── Getters ───────────────────────────────────────────────────────────────────
 
-export async function getSettings(): Promise<Settings> {
+export const getSettings = cache(async (): Promise<Settings> => {
   try {
     const rows = await prisma.settings.findMany();
     const stored: Record<string, string> = {};
@@ -64,7 +65,7 @@ export async function getSettings(): Promise<Settings> {
     // DB unavailable at build time — return defaults
     return { ...SETTINGS_DEFAULTS } as Settings;
   }
-}
+});
 
 export async function getSetting(key: SettingsKey): Promise<string> {
   try {