fix: patch auth bypass via case-sensitive path matching (#77)

- Normalize request path to lowercase before auth check to prevent
  bypassing authentication with uppercase paths like /API/hermes/sessions
- Auto-restart server after in-page update via detached hermes-web-ui restart

Closes #77

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/server/src/services/auth.ts

@@ -48,7 +48,7 @@ export async function authMiddleware(token: string | null) {
     }
 
     // Skip non-API paths (static files, health check, SPA)
-    const path = ctx.path
+    const path = ctx.path.toLowerCase()
     if (
       path === '/health' ||
       (!path.startsWith('/api') && !path.startsWith('/v1') && path !== '/webhook')