MARS-449 follow-up: middleware Supabase session-refresh + setAll no-store headers hardening

Class-A. Split out of MARS-449 P3 (audit-mars-ca APPROVE condition, 2026-07-15). Mars currently refreshes sessions CLIENT-SIDE only (createBrowserClient autoRefresh); middleware.ts only stamps x-mars-pathname. @supabase/ssr 0.12.3 surfaces a 2nd setAll(headers) arg (Cache-Control no-store etc) that Mars ignores — pre-existing, byte-identical to 0.9 behavior, NOT a P3 regression. Add official createServerClient middleware refresh flow. ACCEPTANCE: (1) server-side expired/refreshable-session refresh in middleware; (2) all chunked auth cookies propagate; (3) every setAll response header applied to the mutable response; (4) x-mars-pathname header + matcher behavior preserved (add test: pathname survives response recreation); (5) EDGE-BUNDLE/node:-module validation — createServerClient pulls @supabase/ssr+supabase-js into the _middleware EDGE chunk (the chunk that froze prod on pg, 2213a5a): must validate supabase-js survives edge (no node:-scheme imports, weight OK) via a real Vercel deploy, NOT just next build; (6) invocation-budget impact (adds Supabase client per matched request — Mars is edge-budget-sensitive); (7) fallback/rollback plan. Design-ping audit-mars-ca BEFORE implementing.