Move auth check to frontend for CDN-friendly caching

[zhangzhenghao]

Summary

• Backend: Remove login checks from page routes (/, /login, /privacy, 404) - all routes now directly return static index.html
• Backend: Add /api/me endpoint for frontend to check authentication status
• Backend: Add Cache-Control: private, no-store, no-cache, must-revalidate headers to all /api/* endpoints to prevent CDN caching
• Frontend: Add router guard (beforeEach) to check auth via /api/me before allowing access to protected routes

Benefits

1. CDN-friendly: All page routes return static files that can be safely cached by CDN
2. Reduced backend load: Static file serving can be handled by CDN edge nodes
3. Better performance: Users get faster page loads from CDN cache
4. Security: API endpoints explicitly disable caching to protect user data

Changes

Backend (app.py)

• Removed @login_required and redirect logic from /, /login, /privacy, and page_not_found
• Added /api/me endpoint returning {is_authenticated: true/false, login: string}
• Added Cache-Control header in set_headers() for all /api/* paths

Frontend (frontend/src/main.js)

• Added meta: { requiresAuth: true } to protected routes
• Added router.beforeEach guard that calls /api/me and redirects to /login if not authenticated

Testing

Tested locally:

• Unauthenticated users are redirected to /login when accessing / or /favorites
• Authenticated users can access all routes normally
• /api/me returns correct authentication status