fix: remove stale login.html from public paths, clean up prefixes

Old Tailwind HTML pages removed from server — Vuetify SPA is now
the sole entry at /app/. Only install.html remains for setup wizard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/main.py

@@ -402,16 +402,13 @@ class SecurityHeadersMiddleware:
 
 # Public /app/ paths that anyone can access without login
 _APP_PUBLIC_PATHS = frozenset({
-    "/app/login.html",
     "/app/install.html",
     "/app/forgot-password.html",
     "/app/",          # Vuetify SPA entry (index.html)
     "/app/index.html", # Vuetify SPA entry explicit
 })
 _APP_PUBLIC_PREFIXES = (
-    "/app/vendor/",    # third-party JS/CSS
-    "/app/api.js",     # shared API module (no auth on its own)
-    "/app/layout.js",  # shared layout module
+    "/app/vendor/",    # third-party JS/CSS (install.html dependencies)
 )