fix(cron): exempt /api/cron/* from Clerk auth.protect()

trim-feeds and anniversaries validate their own CRON_SECRET bearer
token, but Clerk's middleware ran auth.protect() first and 307-redirected
every request (including the cron caller) to sign-in before the route
handler's own check ever ran. Same pattern as /api/webhooks/(.*), which
also authenticates itself independently of Clerk.

src/proxy.ts

@@ -14,6 +14,7 @@ const isPublicRoute = createRouteMatcher([
   "/join(.*)",
   "/api/webhooks/(.*)",
   "/api/auth/(.*)",
+  "/api/cron/(.*)",
 ]);
 
 export default clerkMiddleware(async (auth, request) => {