fix(auth): redirect to /login when auth is enabled and accessing root

'/' and '/index.html' were in PUBLIC_PATHS, so setting a password
and refreshing the root URL would show the app blank (JS loaded
but all API calls returned 401) instead of redirecting to /login.

Root and index.html must be protected paths so the browser gets a
302 -> /login when auth is active and no valid session cookie exists.

api/auth.py

@@ -14,7 +14,7 @@ from api.config import STATE_DIR, load_settings
 
 # ── Public paths (no auth required) ─────────────────────────────────────────
 PUBLIC_PATHS = frozenset({
-    '/', '/index.html', '/login', '/health', '/favicon.ico',
+    '/login', '/health', '/favicon.ico',
     '/api/auth/login', '/api/auth/status',
 })