fix(auth): close OAuth token-mutation and arbitrary-path proxy bypasses

isStaticPathExempt() blanket-exempted every /api/oauth* path, letting an
unauthenticated caller POST to init/reauth/callback and overwrite stored
account OAuth tokens even with dashboard auth enabled. It also exempted
any path not starting with /api, /v1, or /messages — intended to let the
dashboard serve its SPA/static assets, but this exemption is consulted by
the same authenticateRequest() used by the proxy fallback in server.ts,
so an arbitrary path (e.g. POST /foo) reached the upstream proxy handler
unauthenticated whenever the dashboard was disabled or its assets were
unavailable.

Fix: remove both blanket exemptions. OAuth read-only status polling
(GET /api/oauth/{qwen,codex}/status/*) stays exempt; init/reauth/callback
now require an API key once auth is enabled (still allowed during
initial setup via the existing no-keys-configured fallback). The
dashboard SPA and static assets are now served directly by the server
BEFORE authentication is consulted at all, so no auth-layer exemption is
needed for legitimate dashboard traffic.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>