fix(#518): guard cookie writes when response headers already sent

[nicokempe]

Types of changes

• Bug fix (a non-breaking change which fixes an issue)
• New feature (a non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

This PR implements a defensive guard for SSR cookie writes.
Previously, setAll unconditionally attempted to call setCookie even when the H3/Node response headers had already been sent. This caused runtime errors and unhandledRejection spam during token refresh in dev after idle:

ERROR Cannot remove headers after they are sent to the client
    at ServerResponse.removeHeader (node:_http_outgoing:848:11)
    at setCookie (h3/dist/index.mjs:615:18)
    at node_modules/@nuxtjs/supabase/dist/runtime/plugins/supabase.server.js:31:111
    at Array.forEach (<anonymous>)
    at setAll (.../node_modules/@nuxtjs/supabase/dist/runtime/plugins/supabase.server.js:31:38)
    at applyServerStorage (.../@supabase/ssr/dist/module/cookies.js:274:9)
    at async Object.callback (.../@supabase/ssr/dist/module/createServerClient.js:51:13)
    at async .../@supabase/auth-js/dist/module/GoTrueClient.js:1604:11
    at async Promise.all (index 1)

The fix introduces a headersWritable check in both runtime/plugins/supabase.server.js and runtime/server/services/serverSupabaseClient.js.
If headers are already sent or the response has ended, cookie writes are skipped.
This prevents crashes and log spam without altering normal behavior when headers are writable.

Resolves: #518

Checklist

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes

[netlify]

✅ Deploy Preview for n3-supabase canceled.

Name	Link
🔨 Latest commit	57a2de5
🔍 Latest deploy log	https://app.netlify.com/projects/n3-supabase/deploys/68bfe6dd0cd13a000821981a

[vercel]

@nicokempe is attempting to deploy a commit to the NuxtLabs Team on Vercel.

A member of the Team first needs to authorize it.

[pkg-pr-new]

npm i https://pkg.pr.new/@nuxtjs/supabase@525

commit: 57a2de5

[larbish]

Thanks @nicokempe, I just factorized your logic into one utility file. Merging! 🚀