fix(caddy): allowlist PUBLIC_PATHS before basic_auth (closes #28)

[thinmintdev]

Closes #28

Summary

The Caddy handle {} block applied basicauth to every path that didn't match /chat* or /v1/*, including the entire FastAPI PUBLIC_PATHS frozenset. The browser-side first-run wizard hits /api/install/state and /api/config/urls before any credential can exist, so hal0 install --auth=basic deployments were unbootstrappable from a browser.

Add a @public named matcher listing every entry from src/hal0/api/middleware/auth.py:PUBLIC_PATHS, paired with a handle @public { reverse_proxy 127.0.0.1:8080 } block placed before the default basicauth handler. Caddy evaluates handle blocks in source order (first match wins), so the matcher must precede the default block — that ordering is exactly what was wrong before.

path matchers in Caddy are exact-match (no prefix expansion unless * is given), which mirrors the request.url.path in PUBLIC_PATHS check on the API side. Two sources of truth stay in lockstep.

Files changed

• packaging/caddy/Caddyfile.template — add @public path ... matcher + handle @public block before the default basicauth handler.
• tests/harness/installer-test.sh — strengthen the auth-basic row to assert the rendered /etc/hal0/Caddyfile contains @public path, handle @public, and /api/install/state. A future edit that drops the allowlist (or re-orders it below the default handle) will be caught here.

Verification

Rendered the template with the same Python substitution the installer uses, ran caddy validate (Valid configuration), then booted Caddy against a stub backend on :18080 and probed 26 paths:

=== Public paths without creds (expect 200) ===
  PASS  public /api/health/system                          HTTP=200
  PASS  public /api/status                                 HTTP=200
  PASS  public /api/metrics                                HTTP=200
  PASS  public /api/metrics/prometheus                     HTTP=200
  PASS  public /api/features                               HTTP=200
  PASS  public /api/install/state                          HTTP=200
  PASS  public /api/install/complete                       HTTP=200
  PASS  public /api/config/urls                            HTTP=200
  PASS  public /api/auth/status                            HTTP=200
  PASS  public /api/auth/login                             HTTP=200
  PASS  public /api/auth/logout                            HTTP=200
  PASS  public /v1/models                                  HTTP=200

=== Protected paths without creds (expect 401) ===
  PASS  protected /api/slots                               HTTP=401
  PASS  protected /api/models                              HTTP=401
  PASS  protected /api/auth/tokens                         HTTP=401
  PASS  protected /                                        HTTP=401
  PASS  protected /api/install/cancel                      HTTP=401
  PASS  protected /api/logs/tail                           HTTP=401
  PASS  protected /api/settings                            HTTP=401

=== Protected paths with WRONG creds (expect 401) ===
  PASS  wrong-creds /api/slots                             HTTP=401
  PASS  wrong-creds /                                      HTTP=401

=== Protected paths with RIGHT creds (expect 200) ===
  PASS  right-creds /api/slots                             HTTP=200
  PASS  right-creds /api/auth/tokens                       HTTP=200
  PASS  right-creds /                                      HTTP=200

=== /v1/* passthrough (no basicauth, expect 200) ===
  PASS  v1-pass /v1/chat/completions                       HTTP=200
  PASS  v1-pass /v1/embeddings                             HTTP=200

===== TOTAL: PASS=26 FAIL=0 =====

The local installer harness auth-basic row could not be exercised end-to-end on this host because preflight blocked on /var/lib disk space and port 8080 (the host already runs an OpenWebUI dev process on 8080). Those preflights are unrelated to the fix; the harness's new grep-based assertions were validated against the rendered output above.

Acceptance criteria

• Rendered Caddyfile contains a @public matcher block above the default handle, forwarding the public-path list to 127.0.0.1:8080 without basic_auth.
• curl https://.../api/install/state returns 200 without credentials (verified against live Caddy with stub backend).
• curl https://.../api/status returns 200 without credentials (same).
• Default authenticated paths still 401 without creds (/api/slots and friends, verified).
• Deferred to a follow-up: new Playwright γ spec opening the FirstRun wizard through Caddy without basic_auth — the e2e suite scaffolding is out of scope for this critical fix. The 26-probe harness above covers the wire-level contract; the Playwright spec belongs with the broader first-run wizard work tracked separately.
• Installer regression test confirms the rendered Caddyfile contains the @public block when --auth=basic is used (new asserts in tests/harness/installer-test.sh row auth-basic).

Follow-up notes (not addressed here, per scope gate)

• caddy validate warns that the basicauth directive is deprecated in favour of basic_auth in Caddy ≥ 2.10. Pre-existing on both protected blocks; rename is a small but separate sweep.
• PUBLIC_PATHS in auth.py and the @public path … list in this template are duplicated by design but must be kept in sync by hand. A render-time generator (or unit test that diffs the two lists) would lock that contract — out of scope here. The harness assertion only checks structural presence + /api/install/state, not every path.
• FINDINGS §21 notes /api/metrics/prometheus is in PUBLIC_PATHS but the route is unimplemented; left as-is to avoid coupling this fix to the route catalogue.

Test plan

• caddy validate against rendered template — clean (one pre-existing deprecation warning).
• Live Caddy + stub backend: 12 public paths → 200, 7 protected paths → 401, wrong-creds → 401, right-creds → 200, /v1/* passthrough → 200.
• CI harness auth-basic row passes on a host where preflight succeeds (depends on the existing CI runner config).