fix: allow / and /static/ paths without token so login page can load

dashboard/app.py

@@ -16,14 +16,17 @@ DB_PATH = os.environ.get("DB_PATH", "/data/messages.db")
 Path(DB_PATH).parent.mkdir(parents=True, exist_ok=True)
 
 TOKEN = os.environ.get("DASHBOARD_TOKEN", "").strip()
-PUBLIC_ROUTES = {"/webhook", "/healthz"}
+# Public: HTML shell + static assets (login page needs to load) + webhook + health
+PUBLIC_ROUTES = {"/", "/webhook", "/healthz"}
+PUBLIC_PREFIXES = ("/static/",)
 
 app = Flask(__name__, static_folder="static", static_url_path="/static")
 
 
 @app.before_request
 def _check_token():
-    if not TOKEN or request.path in PUBLIC_ROUTES:
+    p = request.path
+    if not TOKEN or p in PUBLIC_ROUTES or p.startswith(PUBLIC_PREFIXES):
         return None
     supplied = (
         request.headers.get("Authorization", "").removeprefix("Bearer ").strip()