fix: make /api/auth/login public (middleware was blocking login itself)

src/middleware.ts

@@ -10,6 +10,7 @@ const PUBLIC_PATHS = [
   '/api/aos/licenses/check',
   '/api/aos/licenses/validate',
   '/api/aos/stripe/webhook',
+  '/api/auth/login',
   '/login',
   '/_next',
   '/favicon.ico',
@@ -24,6 +25,7 @@ const PUBLIC_API_PREFIXES = [
   '/api/aos/licenses/check',
   '/api/aos/licenses/validate',
   '/api/aos/stripe/webhook',
+  '/api/auth/login',
   '/api/v1/',  // public REST API (token-auth'd separately)
   '/api/mcp',  // MCP (token-auth'd)
 ]