Infinite redirect to sign-in: your public-route matcher does not cover the sign-in page itself

# Symptom
Visiting any page redirects to sign-in, and the sign-in page itself redirects too. Incognito changes nothing.

# Confirm the cause
1. Open your middleware file and read the `isPublicRoute` list (built with `createRouteMatcher`).
2. Check that it includes every route rendering sign-in/sign-up UI, with catch-all patterns: '/sign-in(.*)' and '/sign-up(.*)', not just the bare paths.
3. Check the root '/' if your landing page is public, and your webhook endpoint path (webhooks must stay public; they authenticate via Svix signatures, not sessions).

# Fix
- Use the inverted pattern, which is the safe default: protect everything EXCEPT the public list.
  ```ts
  import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server'
  const isPublicRoute = createRouteMatcher(['/sign-in(.*)', '/sign-up(.*)', '/'])
  export default clerkMiddleware(async (auth, req) => {
    if (!isPublicRoute(req)) { await auth.protect() }
  })
  ```

# Verify
Open the sign-in page in an incognito window. It must render without redirecting. Then open a protected page signed-out; it must redirect to sign-in exactly once.