test(web): hold every HTTP route to a declared auth expectation

The authorization boundary was one prefix rule plus an allowlist inside
authMiddleware: anything under /api/ needs a token, everything else does not.
A route registered outside /api/ therefore shipped reachable without a token
and nothing failed. The two registration sites — NewServerWithAuth and
RegisterHealthEndpoints — each built their own mux, so neither the reviewer nor
a test saw the whole surface at once.

Extract the routes into one table that both sites consume, with an explicit
public flag per entry, and test the table four ways:

  - every route is replayed through the real middleware chain and must answer
    401 without a token unless it declares itself public
  - the set of public routes is pinned to a literal list, so widening the
    token-free surface means editing the test on purpose
  - registering a route anywhere other than through the table fails, including
    inside newMux, which would otherwise escape the replay
  - authMiddleware may not dispatch on a path beyond its declared exemptions,
    closing the variant where a handler is served from the middleware itself
    and never registered on a mux at all

No route changed its reachability; the table records what the code already did.

Each of the four was verified by breaking it: marking /api/jobs/delete public,
registering /sneaky inside newMux, and adding a /backdoor path check to
authMiddleware each produce exactly the finding they should, naming the route.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM