fix(proxy): auth middleware only for exact /, unmatched paths get greeting

- Move combinedAuth inside the launcher handler path check
- Unmatched proxy paths (not exactly /) now correctly serve NotFoundHandler greeting
- Root / remains auth-gated as intended

src/main.go

@@ -198,15 +198,18 @@ func main() {
 	})
 
 	// --- Proxy routes (all traffic through proxy as catch-all) ---
-	// Launcher dashboard (auth-gated)
+	// Launcher dashboard: auth only for exact "/", unmatched paths get NotFoundHandler
-	launcherHandler := combinedAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	launcherHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/" {
-			// Not the root path — let proxy's NotFoundHandler handle it
+			// Not the root path — let proxy's NotFoundHandler handle it (no auth needed)
 			prx.NotFoundHandler.ServeHTTP(w, r)
 			return
 		}
+		// Only apply auth for the actual dashboard root
+		combinedAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			uiHandler.ServeHTTP(w, r)
-	}))
+		})).ServeHTTP(w, r)
+	})
 
 	// Admin routes use a sub-mux with no-op auth (auth is applied at proxy route level)
 	adminMux := http.NewServeMux()