feat(auth): admit /.well-known/* without a session

Adds the `/.well-known/` prefix to the proxy's `PUBLIC_PATHS` allowlist so
RFC 8615 discovery endpoints reach a 200 response before the auth gate
runs. Apple in particular reads
`/.well-known/apple-app-site-association` without credentials to wire Web
Credentials (passkey sharing) and Universal Links to the iOS bundle, and
the previous 307 redirect to `/auth/login` broke that fetch on every host
the app serves (`healthlog.bombeck.io` and `demo.healthlog.dev` both).

The trailing-slash entry future-proofs the namespace for `/security.txt`,
`/openid-configuration`, and the other well-known endpoints the IETF
registry covers — adding a new file under `src/app/.well-known/` won't
need a second proxy edit.

A regression test pins the allowlist in place: unauthenticated requests
for the AASA file (and a synthetic `/.well-known/security.txt` peer) must
answer 200 with no location header, while a protected page like
`/insights` still 307s to the auth gate.

src/proxy.ts

@@ -33,6 +33,14 @@ const PUBLIC_PATHS = [
   // alongside the project credits. The CC licence requires the
   // attribution to be reachable without a sign-in.
   "/about",
+  // v1.4.33 — `/.well-known/*` covers IETF-registered discovery
+  // endpoints (RFC 8615). Apple reads
+  // `/.well-known/apple-app-site-association` without credentials to
+  // wire Web Credentials (passkey sharing) and Universal Links to the
+  // iOS bundle, so the path must answer 200 with the bare JSON body
+  // before any auth gate runs. The trailing slash future-proofs the
+  // namespace for `/security.txt`, `/openid-configuration`, etc.
+  "/.well-known/",
   // `/onboarding` itself + its subroutes are matched exactly via
   // `isPublicPath()` so we don't admit `/onboarding-export` etc.
   "/robots.txt",