Check where your functions run: Project Settings → Functions → Function Region. The default is Washington D.C. (iad1). So every request goes Amsterdam → US East → Frankfurt for each query → back to US East → Amsterdam. Each transatlantic round trip is ~90ms, and your middleware auth check plus 4 queries (even in parallel, the auth one comes first) adds up fast.
Set it to Frankfurt:
// vercel.json
{
"regions": ["fra1"]
}or change it in the dashboard, then redeploy. Your queries being <5ms in Supabase was the clue: the time isn't in the database, it's in the distance.