Fix: Add auth endpoints to anonymous paths list

- /api/auth/login was being blocked by auth middleware
- Add all auth endpoints to allow_anonymous_paths:
  - /api/auth/login
  - /api/auth/logout
  - /api/auth/refresh
  - /api/auth/bootstrap
  - /api/auth/2fa/verify
  - /api/auth/2fa/resend
  - /oauth
  - /auth/callback

src/security/auth.rs

@@ -530,6 +530,14 @@ impl Default for AuthConfig {
                 "/api/v1/health".to_string(),
                 "/.well-known".to_string(),
                 "/metrics".to_string(),
+                "/api/auth/login".to_string(),
+                "/api/auth/logout".to_string(),
+                "/api/auth/refresh".to_string(),
+                "/api/auth/bootstrap".to_string(),
+                "/api/auth/2fa/verify".to_string(),
+                "/api/auth/2fa/resend".to_string(),
+                "/oauth".to_string(),
+                "/auth/callback".to_string(),
             ],
             public_paths: vec![
                 "/".to_string(),