fix: auth bypass, SPA serving, and provider improvements (#97)

* feat(chat): polish syntax highlighting and tool payload rendering (#94)

* [verified] feat(chat): polish syntax highlighting and tool payload rendering

* [verified] fix(chat): tighten large tool payload rendering

* docs: update data volume path in Docker docs

Align documentation with docker-compose.yml change:
hermes-web-ui-data -> hermes-web-ui, /app/dist/data -> /root/.hermes-web-ui

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: bundle server build and restructure service modules

- Add build-server.mjs script for standalone server compilation
- Add logger service with structured output
- Restructure auth, gateway-manager, hermes-cli, hermes services
- Update docker-compose volume mount path
- Update tsconfig and entry point for bundled server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: separate controllers from routes and centralize route registration

- Extract business logic from route handlers into controllers/
- Add centralized route registry in routes/index.ts with public/auth/protected layers
- Replace global auth whitelist with sequential middleware registration
- Extract shared helpers to services/config-helpers.ts
- Allow custom provider name to be user-editable in ProviderFormModal
- Deduplicate custom providers by poolKey instead of base_url in getAvailable

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: auth bypass via path case, SPA serving, and provider improvements

- Fix auth bypass: path case-insensitive check for /api, /v1, /upload
- Fix SPA returning 401: skip auth for non-API paths (static files)
- Fix profile switch: use local loading state instead of shared store ref
- Auto-append /v1 to base_url when fetching models (frontend + backend)
- Guard .env writing to built-in providers only
- Add builtin field to provider presets, enable base_url input in form
- Print auth token to console on startup (pino only writes to file)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Zhicheng Han <43314240+hanzckernel@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

packages/server/src/services/logger.ts

@@ -0,0 +1,32 @@
+import pino from 'pino'
+import { resolve } from 'path'
+import { mkdirSync, statSync, truncateSync, openSync, readSync, closeSync, writeFileSync } from 'fs'
+import { homedir } from 'os'
+
+const MAX_LOG_SIZE = 3 * 1024 * 1024 // 3MB
+
+const logDir = resolve(homedir(), '.hermes-web-ui', 'logs')
+mkdirSync(logDir, { recursive: true })
+
+const logFile = resolve(logDir, 'server.log')
+
+// Rotate log if it exceeds MAX_LOG_SIZE — truncate to keep the last half
+try {
+  const stat = statSync(logFile)
+  if (stat.size > MAX_LOG_SIZE) {
+    const keepSize = Math.floor(MAX_LOG_SIZE / 2)
+    const fd = openSync(logFile, 'r')
+    const buf = Buffer.alloc(keepSize)
+    readSync(fd, buf, 0, keepSize, stat.size - keepSize)
+    closeSync(fd)
+    truncateSync(logFile, 0)
+    writeFileSync(logFile, buf)
+  }
+} catch {}
+
+export const logger = pino({
+  level: process.env.LOG_LEVEL || 'info',
+}, pino.destination({
+  dest: logFile,
+  sync: false,
+}))