POST /api/auth/theia-check validates the NextAuth session cookie forwarded by Traefik. Returns 200 for authenticated users with X-Auth-User/Email/Name headers, or 302 redirect to /auth for unauthenticated requests — preserving the original Theia URL as callbackUrl so users land back in the IDE after login. Co-authored-by: Cursor <cursoragent@cursor.com>