fix: Gate3 health plain text, refresh empty body, prune underscore chunks

test_api: assert /health returns plain text ok instead of JSON parse.

auth: RefreshRequest.refresh_token optional so SPA POST {} is not 422.

prune: allow leading underscore in asset names to avoid deleting _plugin-vue_export-helper.

Add run_test_api_on_server.sh and deployment follow-up changelog.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/auth.py

@@ -74,7 +74,9 @@ class LoginRequest(BaseModel):
 
 
 class RefreshRequest(BaseModel):
-    refresh_token: str = Field(..., min_length=1)
+    """Body optional — refresh token is read from HttpOnly cookie first."""
+
+    refresh_token: Optional[str] = Field(default=None, min_length=1)
 
 
 class LogoutRequest(BaseModel):
@@ -152,7 +154,7 @@ async def login(
 async def refresh_token(
     request: Request,
     response: Response,
-    payload: Optional[RefreshRequest] = None,
+    payload: RefreshRequest | None = None,
     service: AuthService = Depends(get_auth_service),
 ):
     """Exchange refresh token for new access token (with rotation + version-based reuse detection)