Redirect guests to login in Subscribed middleware

[produktive]

Summary

• Check authentication before subscription status in Subscribed middleware
• Guests now redirect to login with intended URL instead of the billing page

Motivation

When subscribed middleware runs for a guest, the previous logic fell through to route('billing'), which is confusing for unauthenticated visitors.

Test plan

• Guest hitting a subscribed-protected route redirects to login
• Authenticated non-subscriber still redirects to billing
• Authenticated subscriber/admin proceeds normally

Made with Cursor

[produktive]

Superseded by #386, which includes this Subscribed middleware change.