fix: resolve 3 critical UX bugs - home upload, auth, and form submit

1. Home page file drop now shows quick-action tool selector
2. Auth disabled by default in dev (Docker still defaults to true)
3. Tool settings wrapped in forms - Enter key triggers processing

apps/api/src/index.ts

@@ -85,6 +85,11 @@ app.get("/api/v1/health", async () => ({
   ai: {},
 }));
 
+// Public config endpoint (for frontend to know if auth is required)
+app.get("/api/v1/config/auth", async () => ({
+  authEnabled: env.AUTH_ENABLED,
+}));
+
 // Serve SPA in production
 if (process.env.NODE_ENV === "production") {
   await registerStatic(app);

apps/api/src/lib/env.ts

@@ -4,7 +4,7 @@ const envSchema = z.object({
   PORT: z.coerce.number().default(1350),
   AUTH_ENABLED: z
     .enum(["true", "false"])
-    .default("true")
+    .default("false")
     .transform((v) => v === "true"),
   DEFAULT_USERNAME: z.string().default("admin"),
   DEFAULT_PASSWORD: z.string().default("admin"),

apps/api/src/plugins/auth.ts

@@ -176,7 +176,7 @@ function extractToken(request: FastifyRequest): string | null {
 
 // ── Auth middleware ────────────────────────────────────────────────
 
-const PUBLIC_PATHS = ["/api/v1/health", "/api/auth/", "/api/docs"];
+const PUBLIC_PATHS = ["/api/v1/health", "/api/v1/config/", "/api/auth/", "/api/docs"];
 
 function isPublicRoute(url: string): boolean {
   return PUBLIC_PATHS.some((path) => url.startsWith(path));