Let xAIGen accept backup ingest without a browser login.

The 401 was the session wall, not a missing token. The ingest route now uses the shared Bearer secret, and both apps default that secret so Coolify vars are optional.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/middleware/auth.ts

@@ -8,6 +8,7 @@ export default defineEventHandler((event) => {
     path.startsWith('/api/auth/me') ||
     path.startsWith('/api/health') ||
     path.startsWith('/api/monitor') ||
+    path.startsWith('/api/library/backup-ingest') ||
     path.startsWith('/_nuxt') ||
     path.startsWith('/favicon') ||
     path === '/login'

server/utils/backupStudio.ts

@@ -19,6 +19,7 @@ export function backupStudioTarget() {
   const token = String(
     config.backupStudioToken
     || env('BACKUP_STUDIO_TOKEN', 'NUXT_BACKUP_STUDIO_TOKEN')
+    || 'carr-aigen-xaigen-backup'
   ).trim()
   const misplaced = env('BACKUP_INGEST_TOKEN', 'NUXT_BACKUP_INGEST_TOKEN')
   return { url, token, misplaced }
@@ -29,6 +30,7 @@ export function backupIngestSecret() {
   return String(
     config.backupIngestToken
     || env('BACKUP_INGEST_TOKEN', 'NUXT_BACKUP_INGEST_TOKEN', 'BACKUP_STUDIO_TOKEN', 'NUXT_BACKUP_STUDIO_TOKEN')
+    || 'carr-aigen-xaigen-backup'
   ).trim()
 }