UI dashboard breaks when http_listener.secret is set #2

Frontend (libs/base-ui/src/lib/api.ts) does plain fetch() calls to /api/* endpoints with no auth header. Backend, when http_listener.secret is configured, requires an X-Rotom-Secret header on every /api/* route (libs/services/web_server.go#L66-L70, middleware in libs/auth/middleware.go).

Static assets (HTML/JS/CSS) are served without auth, so the UI loads fine, but every fetch (/api/status, /api/config, /api/job, etc.) returns 401. Dashboard ends up blank/broken, with no login screen or any way to supply the secret.

Reproduction steps: set secret under [http_listener] (configs/rotom-ng.toml.example:30), open the UI.