fix(dataroom): use getSessionFromCookie() instead of middleware headers; fix auth page overflow

Dataroom routes were reading x-investor-id from request headers which
the middleware sets as response headers — these don't reach route handlers
when the admin fallback path runs (NextResponse.next() without header).
Switch to getSessionFromCookie() consistent with all other investor routes.

Auth page DSGVO footer switched from absolute bottom-0 to normal flow
so the expanded Art. 13 notice doesn't overlap the login card.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pitch-deck/app/api/dataroom/uploads/route.ts

@@ -1,16 +1,17 @@
 import { NextRequest, NextResponse } from 'next/server'
 import pool from '@/lib/db'
 import { investorUploadDir, saveFile, safeName } from '@/lib/dataroom-storage'
-import { logAudit } from '@/lib/auth'
+import { logAudit, getSessionFromCookie } from '@/lib/auth'
 import { randomUUID } from 'crypto'
 
 export const dynamic = 'force-dynamic'
 
 const MAX_BYTES = parseInt(process.env.DATAROOM_MAX_UPLOAD_MB || '50') * 1024 * 1024
 
-export async function GET(request: NextRequest) {
-  const investorId = request.headers.get('x-investor-id')
-  if (!investorId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+export async function GET(_request: NextRequest) {
+  const session = await getSessionFromCookie()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const investorId = session.sub
 
   const { rows } = await pool.query(
     `SELECT id, filename, display_name, mime_type, file_size, created_at
@@ -23,9 +24,10 @@ export async function GET(request: NextRequest) {
 }
 
 export async function POST(request: NextRequest) {
-  const investorId = request.headers.get('x-investor-id')
-  const sessionId = request.headers.get('x-session-id')
-  if (!investorId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const session = await getSessionFromCookie()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const investorId = session.sub
+  const sessionId = session.sessionId
 
   const formData = await request.formData()
   const file = formData.get('file') as File | null