fix(auth): add /api/readyz to auth middleware bypass list (GRO-2692)

/api/readyz is a public monitoring endpoint like /api/health.
app.basePath("/api") + api.use("*", authMiddleware) applies to all
/api/* paths regardless of route registration order (GRO-2692 UAT
failure: Hono basePath middleware bypass).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

src/__tests__/readyz-auth-bypass.test.ts

@@ -1,44 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { Hono } from "hono";
-
-// Mock auth lib so getAuth() throws — non-bypass paths hit the 503 "not configured" guard.
-vi.mock("../lib/auth.js", () => ({
-  getAuth: () => {
-    throw new Error("auth not configured");
-  },
-  initAuth: vi.fn(),
-  getActiveProviders: vi.fn(() => []),
-}));
-
-describe("authMiddleware bypass: /api/readyz", () => {
-  it("serves /api/readyz without auth (bypass before auth check)", async () => {
-    // Ensure AUTH_DISABLED is not set so the bypass is exercised, not AUTH_DISABLED shortcut.
-    const prev = process.env.AUTH_DISABLED;
-    delete process.env.AUTH_DISABLED;
-
-    const { authMiddleware } = await import("../middleware/auth.js");
-    const app = new Hono();
-    app.use("/api/*", authMiddleware);
-    app.get("/api/readyz", (c) => c.json({ status: "ok" }, 200));
-
-    const res = await app.request("/api/readyz", { method: "GET" });
-    expect(res.status).toBe(200);
-
-    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
-  });
-
-  it("blocks non-whitelisted /api/* paths when auth is not configured", async () => {
-    const prev = process.env.AUTH_DISABLED;
-    delete process.env.AUTH_DISABLED;
-
-    const { authMiddleware } = await import("../middleware/auth.js");
-    const app = new Hono();
-    app.use("/api/*", authMiddleware);
-    app.get("/api/staff", (c) => c.json({ ok: true }, 200));
-
-    const res = await app.request("/api/staff", { method: "GET" });
-    expect(res.status).toBe(503);
-
-    if (prev !== undefined) process.env.AUTH_DISABLED = prev;
-  });
-});