Write Next.js middleware that gates routes without slowing down every request

<context>
Routes that need protection: /dashboard/* and /settings/*, but not /dashboard/public-status
How a valid session is identified: A signed JWT in a session cookie named __session, verified with the app's edge-compatible secret
Where to send unauthenticated users: /login
</context>

<task>
Write middleware.ts to gate the protected routes above. Scope it with a matcher config so it only runs on routes that actually need it — never a blanket middleware that runs on every request including static assets and public pages.
</task>

<constraints>
- Middleware runs on the Edge runtime by default, on every matched request, before any page renders — treat that as a hard latency and API-surface budget. Do only a light check here: read a session cookie/token and verify its signature/expiry. Do not make a database call, an external API call, or anything else with meaningful latency inside middleware.
- If deeper validation is needed (checking the session against a revocation list, loading full user permissions), do that light-then-heavy split: middleware does the cheap signature/expiry check and redirects obviously-invalid requests immediately; the actual page or a layout does the heavier check for anything that passed the cheap gate.
- Use the matcher config (or an explicit path check) to exclude _next/static, _next/image, favicon, and any public routes — don't rely on checking pathname manually inside the middleware body for exclusions that the matcher can handle declaratively.
- On redirect, preserve the original destination (e.g. as a callbackUrl query param) so the user lands back where they meant to go after authenticating.
</constraints>

<output_format>
The middleware.ts file with its config.matcher, followed by one sentence explaining what the middleware does NOT check (and where that heavier check actually lives instead).
</output_format>