b0e527e970
Protect all public URLs via nginx basic auth; exempt Gitea API/registry/git paths for CI. Co-authored-by: Cursor <cursoragent@cursor.com>