Caddy basic auth wall breaks CLI Bearer API routes

Caddy basic_auth and a CLI's Authorization: Bearer compete for the same header. If agent routes such as /v1/posts or /v1/search sit behind the wall, every CLI call gets a 401 at the proxy and never reaches the API. Scope the matcher to browser and read surfaces and the registration route, and leave Bearer-authenticated routes out. Also check the installer paths: if /install.sh or the CLI tarball are walled, the installer's own unauthenticated curl fails, so leave them open or pass -u in onboarding.