Recommend protecting auth close to the resource - #3426

Reframe middleware-based auth gating as no longer recommended in favor of
checks close to the resource. Adds a shared partial, a 'Migrating from
middleware checks' section to protect-pages, swaps createRouteMatcher
patterns to :path*, and softens the clerk-middleware reference callouts to
'no longer recommended'.

Lead with the recommendation (protect access as close to the resource as
possible) instead of demoting middleware gating. Downgrades the callouts from
WARNING to TIP/NOTE, drops the 'no longer recommended'/'wrong layer'/'can fail
to apply' framing, renames the protect-pages section to 'Why protect close to
the resource?', and keeps clerkMiddleware() explicitly supported for non-auth
work.

State plainly that clerkMiddleware() is required and is the right place for
redirects/headers, without 'still'/'remains'/'fully supported' that presuppose
a prior state.

Remove the 'rather than gating in middleware / keeps the check in sync' tail
on the satellite-domains note, strengthen the onboarding callout to a direct
'enforce at the resource' IMPORTANT, and drop 'still' from the sign-in public-route
note.

Drop the 'rather than in your middleware' intro tail, the 'no resource-level
equivalent that is also a security boundary' concession, the 'a layout can
still handle the redirect, but' hedge, the 'no codemod or lint rule yet' line,
and flatten the 'works, but' comparison in the Why section.

…nd auth reference

…vel protection

Restructure clerk-middleware.mdx: reframe createRouteMatcher() to non-auth
route matching and replace the auth-gating sections (Protect routes, multiple
groups, all routes, token types) with one Protecting routes pointer to
protect-pages / authorization-checks / auth({ acceptsToken }). Drop the
middleware option from basic-rbac, the !isPublicRoute sections from the custom
sign-in/up guides, and repoint the verifying-* token-type links to the route
handler approach.

…ce, not a security boundary

…ore-2, session-tasks, mcp, and clerk-middleware notices

…ion check, astro import + redirect target

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…ssues

- nuxt clerk-middleware: match on getRequestURL(event).pathname; event.path
  includes the query string, so /api/admin?page=2 bypassed the new
  matchesRoute examples entirely
- build-mcp-server: make shared prose tool-name-neutral (next uses
  get-clerk-user-data, express uses get_clerk_user_data per clerk/mcp-tools);
  fix mark highlight ranges that ran past both code blocks
- reading: add null guards after currentUser() (typed User | null, examples
  failed strict typecheck)
- use-auth/use-user partials: tanstack filename app/routes -> src/routes to
  match the quickstart and same-page examples
- reading.astro: API route filename src/api -> src/pages/api (Astro only
  serves endpoints under src/pages)
- astro clerk-middleware: reword :path* NOTE with framework-neutral rationale

…-resource-guidance

# Conflicts:
#	docs/guides/ai/mcp/build-mcp-server.mdx

…-resource-guidance

# Conflicts:
#	docs/_partials/nextjs/next-steps.mdx
#	docs/getting-started/quickstart.nuxt.mdx

…ewrites