fix: add Bing wallpaper proxy endpoint, make it public (no JWT required)

- Added GET /api/settings/bing-wallpaper — proxies cn.bing.com HPImageArchive
  to avoid CORS issues, returns {url} for the daily wallpaper
- Added /api/settings/bing-wallpaper to PUBLIC_PREFIXES in auth_jwt.py
  so the login page can fetch it without authentication
- Login page now fetches wallpaper via backend proxy instead of direct CORS-blocked fetch

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/api/settings.py

@@ -1261,3 +1261,25 @@ def _retry_to_dict(job: PushRetryJob) -> dict:
         "last_error": job.last_error,
         "created_at": str(job.created_at) if job.created_at else None,
     }
+
+
+# ── Bing Daily Wallpaper Proxy (avoids CORS, returns image URL) ──
+@router.get("/bing-wallpaper", response_model=dict)
+async def bing_wallpaper():
+    """Proxy the Bing HPImageArchive API and return the daily wallpaper URL.
+    No auth required — used by the login page."""
+    import httpx
+    try:
+        async with httpx.AsyncClient(timeout=8.0) as client:
+            resp = await client.get(
+                "https://cn.bing.com/HPImageArchive.aspx",
+                params={"format": "js", "idx": 0, "n": 1, "mkt": "zh-CN"},
+            )
+            data = resp.json()
+            img = (data.get("images") or [{}])[0]
+            url = img.get("url")
+            if url:
+                return {"url": f"https://cn.bing.com{url}"}
+    except Exception:
+        pass
+    return {"url": None}