pub fn is_shell_path(path: &str) -> bool
True for the unauthenticated shell paths (/me + its static assets). The proxy’s auth guard exempts exactly these — the data API stays guarded.
/me