fix: separate public and authenticated file endpoints

dashboard/backend/routers/files.py

@@ -13,6 +13,7 @@ from config import VOLUME_ROOT
 from rbac import require_admin
 
 router = APIRouter()
+public_router = APIRouter()  # For endpoints that don't require auth
 logger = logging.getLogger(__name__)
 BASE = Path(VOLUME_ROOT)
 
@@ -117,7 +118,7 @@ def create_download_token(path: str):
         raise HTTPException(status_code=403, detail="Access denied")
 
 
-@router.get("/download")
+@public_router.get("/download")
 def download(path: str = None, token: str = Query(None)):
     """Download a file. Supports both authenticated access (path param) and token-based access (token param)."""
     try: