feat: ship agent-first mission control v0.2.57

backend/Controllers/AuthController.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.Extensions.Diagnostics.HealthChecks;
@@ -19,6 +20,7 @@ public class AuthController(
     LoginAttemptTracker attemptTracker) : ControllerBase
 {
     [HttpGet("csrf")]
+    [AllowAnonymous]
     public IActionResult GetCsrfToken()
     {
         var tokens = antiforgery.GetAndStoreTokens(HttpContext);
@@ -26,6 +28,7 @@ public class AuthController(
     }
 
     [HttpPost("login")]
+    [AllowAnonymous]
     [EnableRateLimiting("auth")]
     public async Task<IResult> Login([FromBody] LoginRequest request, CancellationToken ct)
     {
@@ -68,6 +71,7 @@ public class AuthController(
     }
 
     [HttpPost("refresh")]
+    [AllowAnonymous]
     [EnableRateLimiting("auth")]
     public async Task<IResult> Refresh(CancellationToken ct)
     {
@@ -89,6 +93,7 @@ public class AuthController(
     }
 
     [HttpPost("logout")]
+    [AllowAnonymous]
     public async Task<IResult> Logout(CancellationToken ct)
     {
         if (Request.Cookies.TryGetValue("nexus_refresh", out var refreshToken))
@@ -123,6 +128,7 @@ public class AuthController(
     }
 
     [HttpPost("admin-reset-password")]
+    [AllowAnonymous]
     [EnableRateLimiting("agents")]
     public async Task<IResult> AdminResetPassword([FromBody] AdminResetPasswordRequest request, CancellationToken ct)
     {