fix: add auth to /upload endpoint to resolve 401 on file attachment

Fixes #10

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/services/auth.ts

@@ -51,7 +51,7 @@ export async function authMiddleware(token: string | null) {
     const path = ctx.path
     if (
       path === '/health' ||
-      (!path.startsWith('/api') && !path.startsWith('/v1') && path !== '/upload' && path !== '/webhook')
+      (!path.startsWith('/api') && !path.startsWith('/v1') && path !== '/webhook')
     ) {
       await next()
       return

src/stores/chat.ts

@@ -51,7 +51,12 @@ async function uploadFiles(attachments: Attachment[]): Promise<{ name: string; p
   for (const att of attachments) {
     if (att.file) formData.append('file', att.file, att.name)
   }
-  const res = await fetch('/upload', { method: 'POST', body: formData })
+  const token = localStorage.getItem('hermes_api_key') || ''
+  const res = await fetch('/upload', {
+    method: 'POST',
+    body: formData,
+    headers: token ? { Authorization: `Bearer ${token}` } : {},
+  })
   if (!res.ok) throw new Error(`Upload failed: ${res.status}`)
   const data = await res.json() as { files: { name: string; path: string }[] }
   return data.files