Fix middleware ordering: device_id must be outermost

FastAPI runs the last-registered middleware first on request.
device_id_middleware was inner, so silent_auth_check's early
redirect bypassed it — cookie never set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/__init__.py

@@ -49,31 +49,8 @@ def create_app() -> FastAPI:
     async def shutdown():
         await close_db()
 
-    # Device ID middleware — track browser identity across domains
-    @app.middleware("http")
-    async def device_id_middleware(request: Request, call_next):
-        did = request.cookies.get(_DEVICE_COOKIE)
-        if did:
-            request.state.device_id = did
-            request.state._new_device_id = False
-        else:
-            request.state.device_id = secrets.token_urlsafe(32)
-            request.state._new_device_id = True
-
-        response = await call_next(request)
-
-        if getattr(request.state, "_new_device_id", False):
-            response.set_cookie(
-                key=_DEVICE_COOKIE,
-                value=request.state.device_id,
-                max_age=_DEVICE_COOKIE_MAX_AGE,
-                httponly=True,
-                samesite="lax",
-                secure=True,
-            )
-        return response
-
     # Silent auth check — auto-login via prompt=none OAuth
+    # NOTE: registered BEFORE device_id so device_id is outermost (runs first)
     @app.middleware("http")
     async def silent_auth_check(request: Request, call_next):
         path = request.url.path
@@ -121,6 +98,31 @@ def create_app() -> FastAPI:
             status_code=302,
         )
 
+    # Device ID middleware — track browser identity across domains
+    # Registered AFTER silent_auth_check so it's outermost (always runs)
+    @app.middleware("http")
+    async def device_id_middleware(request: Request, call_next):
+        did = request.cookies.get(_DEVICE_COOKIE)
+        if did:
+            request.state.device_id = did
+            request.state._new_device_id = False
+        else:
+            request.state.device_id = secrets.token_urlsafe(32)
+            request.state._new_device_id = True
+
+        response = await call_next(request)
+
+        if getattr(request.state, "_new_device_id", False):
+            response.set_cookie(
+                key=_DEVICE_COOKIE,
+                value=request.state.device_id,
+                max_age=_DEVICE_COOKIE_MAX_AGE,
+                httponly=True,
+                samesite="lax",
+                secure=True,
+            )
+        return response
+
     # Initialize Jinja2 templates
     template_dir = Path(__file__).parent / "templates"
     app.state.templates = create_jinja_env(template_dir)