feat: exempt /api/instance-info from auth

muxplex/auth.py

@@ -134,7 +134,7 @@ def authenticate_pam(username: str, password: str) -> bool:
 # ---------------------------------------------------------------------------
 
 # Paths that bypass auth (login page itself, static assets it needs)
-_AUTH_EXEMPT_PATHS = {"/login", "/auth/mode", "/auth/logout"}
+_AUTH_EXEMPT_PATHS = {"/login", "/auth/mode", "/auth/logout", "/api/instance-info"}
 
 # Socket-level localhost addresses — cannot be forged via HTTP headers
 _LOCALHOST_ADDRS = {"127.0.0.1", "::1"}

muxplex/tests/test_auth.py

@@ -447,3 +447,16 @@ def test_resolve_auth_generates_password_as_last_resort(monkeypatch, capsys, tmp
     assert len(pw) > 10
     assert "generated" in captured.err
     assert pw in captured.err
+
+
+def test_middleware_instance_info_path_excluded():
+    """/api/instance-info is excluded from auth (public metadata endpoint)."""
+    app = _make_test_app()
+
+    @app.get("/api/instance-info")
+    async def instance_info():
+        return PlainTextResponse("info")
+
+    client = TestClient(app, base_url="http://192.168.1.1")
+    response = client.get("/api/instance-info")
+    assert response.status_code == 200