An NGINX auth_request chain protects the UI and one API path still bypasses policy

A reverse proxy centralizes auth and later only API clients or browser preflight flows can reach one path without the expected policy check.