Enforce access code from frontend configuration

[TimUx]

Summary

• add a fallback that reads the generated frontend config for the access code so API routes are protected even when the environment variable is not set

Testing

• not run (not requested)

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle config.js files with leading comments

When ACCESS_CODE is unset but only provided in the bundled frontend config, the new fallback always returns an empty string because it requires config.js to start directly with "window.FPP_CONFIG =". The default config.js and template in this repo both begin with a comment, so the prefix check fails and control endpoints stay unprotected even though the frontend is configured with an access code. This affects deployments that rely on the checked-in config instead of the docker-generated one.

Useful? React with 👍 / 👎.