Add a password-gated private instance mode for xaigen.

Keep Authentik on aigen, isolate library data per instance, and purge Comfy outputs from the desktop after they are saved on the server.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/middleware/auth.ts

@@ -2,7 +2,10 @@ export default defineEventHandler((event) => {
   if (!authEnabled()) return
   const path = event.path || getRequestURL(event).pathname
   if (
-    path.startsWith('/api/auth') ||
+    path.startsWith('/api/auth/login') ||
+    path.startsWith('/api/auth/callback') ||
+    path.startsWith('/api/auth/logout') ||
+    path.startsWith('/api/auth/me') ||
     path.startsWith('/api/health') ||
     path.startsWith('/_nuxt') ||
     path.startsWith('/favicon') ||