fix: auth bypass, SPA serving, and provider improvements (#97)

* feat(chat): polish syntax highlighting and tool payload rendering (#94)

* [verified] feat(chat): polish syntax highlighting and tool payload rendering

* [verified] fix(chat): tighten large tool payload rendering

* docs: update data volume path in Docker docs

Align documentation with docker-compose.yml change:
hermes-web-ui-data -> hermes-web-ui, /app/dist/data -> /root/.hermes-web-ui

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: bundle server build and restructure service modules

- Add build-server.mjs script for standalone server compilation
- Add logger service with structured output
- Restructure auth, gateway-manager, hermes-cli, hermes services
- Update docker-compose volume mount path
- Update tsconfig and entry point for bundled server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: separate controllers from routes and centralize route registration

- Extract business logic from route handlers into controllers/
- Add centralized route registry in routes/index.ts with public/auth/protected layers
- Replace global auth whitelist with sequential middleware registration
- Extract shared helpers to services/config-helpers.ts
- Allow custom provider name to be user-editable in ProviderFormModal
- Deduplicate custom providers by poolKey instead of base_url in getAvailable

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: auth bypass via path case, SPA serving, and provider improvements

- Fix auth bypass: path case-insensitive check for /api, /v1, /upload
- Fix SPA returning 401: skip auth for non-API paths (static files)
- Fix profile switch: use local loading state instead of shared store ref
- Auto-append /v1 to base_url when fetching models (frontend + backend)
- Guard .env writing to built-in providers only
- Add builtin field to provider presets, enable base_url input in form
- Print auth token to console on startup (pino only writes to file)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Zhicheng Han <43314240+hanzckernel@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

packages/server/src/routes/hermes/gateways.ts

@@ -1,71 +1,9 @@
 import Router from '@koa/router'
+import * as ctrl from '../../controllers/hermes/gateways'
 
 export const gatewayRoutes = new Router()
 
-// Get singleton instance — set during bootstrap
-let manager: any = null
-
-export function setGatewayManager(mgr: any) {
-  manager = mgr
-}
-
-export function getGatewayManager(): any {
-  return manager
-}
-
-// List all gateway statuses
-gatewayRoutes.get('/api/hermes/gateways', async (ctx) => {
-  if (!manager) {
-    ctx.status = 503
-    ctx.body = { error: 'GatewayManager not initialized' }
-    return
-  }
-  const gateways = await manager.listAll()
-  ctx.body = { gateways }
-})
-
-// Start a profile's gateway
-gatewayRoutes.post('/api/hermes/gateways/:name/start', async (ctx) => {
-  if (!manager) {
-    ctx.status = 503
-    ctx.body = { error: 'GatewayManager not initialized' }
-    return
-  }
-  const { name } = ctx.params
-  try {
-    const status = await manager.start(name)
-    ctx.body = { success: true, gateway: status }
-  } catch (err: any) {
-    ctx.status = 500
-    ctx.body = { error: err.message }
-  }
-})
-
-// Stop a profile's gateway
-gatewayRoutes.post('/api/hermes/gateways/:name/stop', async (ctx) => {
-  if (!manager) {
-    ctx.status = 503
-    ctx.body = { error: 'GatewayManager not initialized' }
-    return
-  }
-  const { name } = ctx.params
-  try {
-    await manager.stop(name)
-    ctx.body = { success: true }
-  } catch (err: any) {
-    ctx.status = 500
-    ctx.body = { error: err.message }
-  }
-})
-
-// Check a profile's gateway health
-gatewayRoutes.get('/api/hermes/gateways/:name/health', async (ctx) => {
-  if (!manager) {
-    ctx.status = 503
-    ctx.body = { error: 'GatewayManager not initialized' }
-    return
-  }
-  const { name } = ctx.params
-  const status = await manager.detectStatus(name)
-  ctx.body = { gateway: status }
-})
+gatewayRoutes.get('/api/hermes/gateways', ctrl.list)
+gatewayRoutes.post('/api/hermes/gateways/:name/start', ctrl.start)
+gatewayRoutes.post('/api/hermes/gateways/:name/stop', ctrl.stop)
+gatewayRoutes.get('/api/hermes/gateways/:name/health', ctrl.health)