fix(api): add /api/readyz to authMiddleware bypass (GRO-2687 UAT fix)

/api/readyz was returning 401 Unauthorized in UAT (GRO-2692 Shedward
regression). The authMiddleware for /api/* did not whitelist /api/readyz,
causing every unauthenticated probe request to be rejected.

Add /api/readyz to the bypass condition alongside /api/auth/* and
/api/health. Add readyz-auth-bypass.test.ts confirming the route passes
through the middleware without auth and that non-whitelisted paths still
block (503 when auth not configured).

Closes GRO-2692 regression (UAT fail).

src/__tests__/readyz-auth-bypass.test.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect, vi } from "vitest";
+import { Hono } from "hono";
+
+// Mock auth lib so getAuth() throws — non-bypass paths hit the 503 "not configured" guard.
+vi.mock("../lib/auth.js", () => ({
+  getAuth: () => {
+    throw new Error("auth not configured");
+  },
+  initAuth: vi.fn(),
+  getActiveProviders: vi.fn(() => []),
+}));
+
+describe("authMiddleware bypass: /api/readyz", () => {
+  it("serves /api/readyz without auth (bypass before auth check)", async () => {
+    // Ensure AUTH_DISABLED is not set so the bypass is exercised, not AUTH_DISABLED shortcut.
+    const prev = process.env.AUTH_DISABLED;
+    delete process.env.AUTH_DISABLED;
+
+    const { authMiddleware } = await import("../middleware/auth.js");
+    const app = new Hono();
+    app.use("/api/*", authMiddleware);
+    app.get("/api/readyz", (c) => c.json({ status: "ok" }, 200));
+
+    const res = await app.request("/api/readyz", { method: "GET" });
+    expect(res.status).toBe(200);
+
+    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
+  });
+
+  it("blocks non-whitelisted /api/* paths when auth is not configured", async () => {
+    const prev = process.env.AUTH_DISABLED;
+    delete process.env.AUTH_DISABLED;
+
+    const { authMiddleware } = await import("../middleware/auth.js");
+    const app = new Hono();
+    app.use("/api/*", authMiddleware);
+    app.get("/api/staff", (c) => c.json({ ok: true }, 200));
+
+    const res = await app.request("/api/staff", { method: "GET" });
+    expect(res.status).toBe(503);
+
+    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
+  });
+});

src/middleware/auth.ts

@@ -23,7 +23,7 @@ if (process.env.AUTH_DISABLED === "true") {
 }
 
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health") {
+  if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health" || c.req.path === "/api/readyz") {
     await next();
     return;
   }