feat(web): public read-only file browser — GET API public, writes require admin

- /api/v1/* GET (list buckets/objects, download) no longer requires auth
- POST/DELETE/PUT stay behind requireAuth (upload, create/delete bucket, copy, delete object)
- FE drops blocking login screen: visitors browse + download freely
- Admin-only UI (create bucket, upload dropzone, delete, S3 creds) hidden in read-only mode
- Login button in topbar to unlock admin actions

src/interfaces/http/routes/index.ts

@@ -109,8 +109,11 @@ export const routes = {
   '/api/v1/auth/me': {
     GET: handleMe,
   },
+  // Read endpoints (GET) are public — anyone can list buckets/objects and
+  // download files. Write endpoints (POST/DELETE/PUT) require admin auth so
+  // visitors cannot upload, edit, copy, or delete.
   '/api/v1/*': {
-    GET: requireAuth(handleWebApiV1),
+    GET: handleWebApiV1,
     POST: requireAuth(handleWebApiV1),
     DELETE: requireAuth(handleWebApiV1),
     PUT: requireAuth(handleWebApiV1),