fix(dataroom): use getSessionFromCookie() instead of middleware headers; fix auth page overflow

Dataroom routes were reading x-investor-id from request headers which
the middleware sets as response headers — these don't reach route handlers
when the admin fallback path runs (NextResponse.next() without header).
Switch to getSessionFromCookie() consistent with all other investor routes.

Auth page DSGVO footer switched from absolute bottom-0 to normal flow
so the expanded Art. 13 notice doesn't overlap the login card.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pitch-deck/app/api/dataroom/documents/[id]/download/route.ts

@@ -1,15 +1,16 @@
 import { NextRequest, NextResponse } from 'next/server'
 import pool from '@/lib/db'
 import { streamFile } from '@/lib/dataroom-storage'
-import { logAudit } from '@/lib/auth'
+import { logAudit, getSessionFromCookie } from '@/lib/auth'
 import path from 'path'
 
 interface Ctx { params: Promise<{ id: string }> }
 
 export async function GET(request: NextRequest, ctx: Ctx) {
-  const investorId = request.headers.get('x-investor-id')
-  const sessionId = request.headers.get('x-session-id')
-  if (!investorId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const session = await getSessionFromCookie()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const investorId = session.sub
+  const sessionId = session.sessionId
 
   const { id } = await ctx.params
 

pitch-deck/app/api/dataroom/documents/route.ts

@@ -1,11 +1,13 @@
 import { NextRequest, NextResponse } from 'next/server'
 import pool from '@/lib/db'
+import { getSessionFromCookie } from '@/lib/auth'
 
 export const dynamic = 'force-dynamic'
 
 export async function GET(request: NextRequest) {
-  const investorId = request.headers.get('x-investor-id')
-  if (!investorId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const session = await getSessionFromCookie()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const investorId = session.sub
 
   const { rows } = await pool.query(
     `SELECT d.id, d.filename, d.display_name, d.mime_type, d.file_size, r.released_at