fix: allow Vuetify SPA index.html through AppAuthMiddleware

The new Vuetify SPA uses hash routing — all pages served from single
index.html. The old middleware only whitelisted individual HTML page
paths (login.html etc.), blocking the SPA entry point with 404.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/main.py

@@ -405,6 +405,8 @@ _APP_PUBLIC_PATHS = frozenset({
     "/app/login.html",
     "/app/install.html",
     "/app/forgot-password.html",
+    "/app/",          # Vuetify SPA entry (index.html)
+    "/app/index.html", # Vuetify SPA entry explicit
 })
 _APP_PUBLIC_PREFIXES = (
     "/app/vendor/",    # third-party JS/CSS