fix(auth): enforce public path boundaries

[yyqdbngt]

Summary

• require public documentation and health endpoints to match a complete path segment
• keep valid descendants such as /swagger-ui/index.html and /actuator/health/readiness public
• add regression coverage for lookalike protected paths

Why

The authentication interceptor previously used raw prefix checks for public endpoint trees. That also exempted unrelated paths such as /api-docs-private and /actuator/healthcheck whenever login enforcement was enabled.

Testing

• mvn -Dmaven.repo.local=D:\taiyi-maven-cache -Dtest=AuthInterceptorTest test (passes)
• Full server suite was attempted on Windows: 2037 tests ran; unrelated existing CLI-agent shell assumptions and AliyunInstanceProviderTest.getGroupProgressShouldMapLagRowsTest failed.

[RockteMQ-AI]

Summary

Fixes an auth bypass vulnerability where path.startsWith("/api-docs") would incorrectly allow paths like /api-docs-private or /swagger-ui-admin to bypass authentication. The new isPathOrDescendant helper properly enforces path boundaries by requiring either an exact match or a / separator.

Security-critical fix. Excellent test coverage including negative cases for paths that only share a prefix.

LGTM.

---

Automated review by github-manager-bot