Block /auth/:path, nothing else. (#6949)

* Block /auth/:path, nothing else.

* Also add /signup

apps/web/next.config.js

@@ -185,8 +185,16 @@ const nextConfig = {
   async headers() {
     return [
       {
-        // prettier-ignore
-        source: "/:path*((?<!\/embed$)(?<!\/embed\/preview\.html$))",
+        source: "/auth/:path*",
+        headers: [
+          {
+            key: "X-Frame-Options",
+            value: "DENY",
+          },
+        ],
+      },
+      {
+        source: "/signup",
         headers: [
           {
             key: "X-Frame-Options",