The auth check failed open: it read a cache built by polling frps, so a failed fetch quietly made every gated tunnel public. frp has server plugins for this, so NewProxy/CloseProxy push now and unknown means deny. Also drops the public /api/* proxy in favour of a filtered /tunnels on bore-auth, and fixes an open redirect in the login flow.