feat(auth): require JWT for GET /api/* endpoints with optional public demo mode

[TFT444]

What does this PR do?

Fixes a security gap where all GET requests to /api/* were publicly accessible without a JWT. Real Azure scan data including findings, compliance status, score, and resources should not be readable without authentication in production.

Type of change

• Bug fix
• API endpoint
• Documentation

Changes

api/app.py — removed _is_public_get() which was making all /api/* GET routes public. Replaced with _ALWAYS_PUBLIC set containing only / and /health. Added OPENSHIELD_PUBLIC_DEMO=true env var support so deployments running a public demo dashboard can still allow unauthenticated GET requests explicitly. Added DATABASE_URL guard so the app can start without a database during tests and local dev.

tests/test_auth.py — new test file covering default mode (GET /api/* returns 401 without JWT) and demo mode (GET /api/* allowed without JWT, POST always requires JWT, /health always public).

.github/workflows/ci.yml — added tests/test_auth.py to the CI pytest command so auth coverage is enforced on every PR.

docs/api-reference.md — updated auth section to reflect the new default behavior and added a reference table explaining demo mode vs production mode.

Acceptance criteria

• /health remains public in all environments
• Production /api/* GET routes return 401 without a valid JWT by default
• Public demo mode can explicitly allow unauthenticated GET routes via OPENSHIELD_PUBLIC_DEMO=true
• Docs explain when JWT is required and when demo mode applies
• Tests cover default production behavior and explicit public demo behavior

Testing

• Verified locally — app starts without DATABASE_URL
• No hardcoded credentials or secrets
• All CI checks passing

Checklist

• My code follows the patterns in CONTRIBUTING.md
• I have not committed any real Azure credentials or secrets
• My branch name follows the convention: feat/description

Related issue

Closes #141

[Vishnu2707]

@TFT444 , kindly fix the conflicts!

Revisit the PR

[TFT444]

@Vishnu2707 Conflict has been resolved!