Gate config-service endpoints behind authentication and split out a small pre-login endpoint

[Yicong-Huang]

Task Summary

config-service currently exposes every config endpoint (/api/config/gui, /api/config/user-system) as @PermitAll, so any anonymous caller can read the full GUI configuration. Only a small subset of these fields is actually needed before login. Split out the pre-login fields into a dedicated /api/config/pre-login endpoint and require authentication on the rest.

Task Type

• Other