heavily simplify server and app content. unify styling

server/utils/authSkipPaths.js

@@ -1,30 +1,21 @@
-/**
- * Paths that skip auth middleware (no session required).
- * Do not add a path here if any handler under it uses requireAuth (with or without role).
- * When adding a new API route that requires auth, add its path prefix to PROTECTED_PATH_PREFIXES below
- * so tests can assert it is never skipped.
- */
-export const SKIP_PATHS = [
+/** Paths that skip auth (no session required). Do not add if any handler uses requireAuth. */
+export const SKIP_PATHS = Object.freeze([
   '/api/auth/login',
   '/api/auth/logout',
   '/api/auth/config',
   '/api/auth/oidc/authorize',
   '/api/auth/oidc/callback',
-]
+])
 
-/**
- * Path prefixes for API routes that require an authenticated user (or role).
- * Every path in this list must NOT be skipped (skipAuth must return false).
- * Used by tests to prevent protected routes from being added to SKIP_PATHS.
- */
-export const PROTECTED_PATH_PREFIXES = [
+/** Path prefixes for protected routes. Used by tests to ensure they're never in SKIP_PATHS. */
+export const PROTECTED_PATH_PREFIXES = Object.freeze([
   '/api/cameras',
   '/api/devices',
   '/api/live',
   '/api/me',
   '/api/pois',
   '/api/users',
-]
+])
 
 export function skipAuth(path) {
   if (path.startsWith('/api/health') || path === '/health') return true