1. The Next.js team acknowledged that the hydration errors are hard to debug and in the Next.js 15 RC they improved on that (the only reason why Next 15 isn't out is that React 19 hasn't released yet because they want to polish things with Suspense up)
2. If you had read the docs, you would have seen that “use client” still does SSR (as it worked in the Next versions before (nothing has changed)). If you want to turn off SSR, you can look at the docs and see that you can do it with the dynamic import (as it worked before in the pages router).
3. Next.js still uses Webpack because they bet on Turbopack and to be fair the release of Turbopack is a bit slow. But with it, we get a massive speed boost. Already, 100% of the tests for dev mode are passing, so you really should try it out.
4. next-auth is an entirely different thing from next. next is not responsible for the next-auth APIs
5. AFAIK, everything runs in node except the middleware if you don't specify the export runtime = "edge";
I think the bigger question is: Why are you violating your own security policy by keeping track on what we browse. I though my browsing is private and hidden away from you but if you store my browsing data in your firebase this is not acceptable at all.