Replace hardcoded public-path whitelist with route registry

Previously internal/api/middleware.go contained an isBootstrapPublic
function with a hardcoded switch over public paths plus three /css/ /js/
/images/ prefix checks. Whenever a new public route was added in
server.go a developer also had to remember to extend the switch — easy
to miss, and the symptom is a silent 307 to /bootstrap.html.

Public-route metadata now lives on the Middleware itself:
  * Middleware gets publicPaths map[string]bool and publicPrefixes []string
  * RegisterPublic(path) / RegisterPublicPrefix(prefix) populate the registry
  * BootstrapRedirect consults isPublic(path) instead of a hardcoded list

Server.routes() registers each public route through new helpers
(handlePublic / handlePublicFunc / handlePublicPrefix) so the mux pattern
and the bypass set are declared together — there is no separate whitelist
to keep in sync.

Routes migrated: 14 exact (bootstrap/login {/api,/api/v1/auth} variants,
/healthz, /readyz, /login.html, /bootstrap.html, /favicon.{ico,svg},
/logo.{png,svg}, /manifest.json, /sw.js) and 4 prefixes (/css/, /js/,
/images/, /s/ for tokenised share URLs).

TestMiddleware_BootstrapRedirect now seeds the registry explicitly
(middleware-level unit test, no full server). A new TestServer_PublicRouteRegistry
asserts the full set of public paths is registered after NewServer().

Refs: agent task ha.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions