fix: deny-by-default API auth + safe SSE controller

src/proxy.js

@@ -1,18 +1,5 @@
 export { proxy } from "./dashboardGuard";
 
 export const config = {
-  matcher: [
-    "/",
-    "/dashboard/:path*",
-    "/api/shutdown",
-    "/api/settings/:path*",
-    "/api/keys",
-    "/api/keys/:path*",
-    "/api/providers/client",
-    "/api/provider-nodes/validate",
-    "/api/cli-tools/:path*",
-    "/api/mcp/:path*",
-    "/api/translator/:path*",
-    "/api/tunnel/:path*",
-  ],
+  matcher: ["/((?!_next/static|_next/image|favicon\\.ico).*)"],
 };