Allow guest city APIs and normalize auth probe responses

frontend/app/api/auth/me/route.ts

@@ -20,6 +20,14 @@ export async function GET(req: NextRequest) {
       headers: auth.headers,
       cache: "no-store",
     });
+    if (res.status === 401 || res.status === 403) {
+      const response = NextResponse.json({
+        authenticated: false,
+        subscription_active: false,
+        points: 0,
+      });
+      return applyAuthResponseCookies(response, auth.response);
+    }
     if (!res.ok) {
       const raw = await res.text();
       const response = NextResponse.json(

frontend/middleware.ts

@@ -47,7 +47,13 @@ function isPublicPage(pathname: string) {
 }
 
 function isPublicApi(pathname: string) {
-  return pathname === "/api/cities" || /^\/api\/city\/[^/]+\/summary$/i.test(pathname);
+  return (
+    pathname === "/api/auth/me" ||
+    pathname === "/api/cities" ||
+    pathname === "/api/vitals" ||
+    /^\/api\/city\/[^/]+$/i.test(pathname) ||
+    /^\/api\/city\/[^/]+\/summary$/i.test(pathname)
+  );
 }
 
 function handleLegacyTokenGate(request: NextRequest) {