- Add lib/auth.ts with decodeJWT() and isTokenValid() - Layout decodes JWT directly - no extra request - Domains page also uses JWT for admin check - Removed redundant user.domains from domains list page