refactor: Simplify session.user handling in authentication

- Removed unnecessary check for session.user existence, ensuring it is always populated with token data.
- Updated comments to clarify session return behavior when token validation fails, allowing NextAuth to manage invalid tokens.

lib/auth.ts

@@ -84,10 +84,6 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
       })
       // Always ensure session.user exists when token exists
       if (token && (token.id || token.email)) {
-        // Ensure session.user is always an object
-        if (!session.user) {
-          session.user = {} as any
-        }
         session.user = {
           ...session.user,
           id: token.id as string,
@@ -115,8 +111,7 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
           tokenId: token?.id,
           tokenEmail: token?.email
         })
-        // Return null if no valid token - this will cause auth() to return null
+        // Return session even if token is invalid - NextAuth will handle validation
-        return null
       }
       // Explicitly return session to ensure it's returned
       return session