At most one auth library wired up

Two active auth libraries means two independent systems of record for who a user is. Password reset may work in NextAuth but silently fail for Clerk-authenticated users. Session revocation on logout may only fire in one library, leaving valid sessions alive in the other. OWASP A07 (Identification & Authentication Failures) and CWE-287 both flag fragmented identity systems as a direct path to authentication bypass — attackers can exploit the gap between which library enforces your authorization checks and which issued the session token they forged. Every route that trusts the wrong library is unprotected.

Pick one auth library and route every session lookup through it. Delete the runner-up's session-getting code, consolidate into a single src/lib/auth.ts helper, then npm uninstall the discarded package.

// src/lib/auth.ts — single canonical session helper
import { getServerSession } from 'next-auth'
import { authOptions } from './auth-options'

export function getSession() {
  return getServerSession(authOptions)
}

Search for any remaining imports of the removed library with grep -r "@clerk/nextjs\|lucia" src/ and eliminate them before deploying.