Open monitor UI on private Space (owner was locked out of own live view)

Gating / and /api/* on the API key locked the Space owner out: a private HF
Space serves its subdomain behind HF auth, and the browser can't attach ?key=
there, so the UI returned 401. The Space being private already restricts who
can reach it to the owner, so the UI (/, /api/*, /chrome.log) is open again.
Only the programmatic AI gateway (/gpt /gemini /flow) and /logs stay key-gated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

monitor/main.go

@@ -622,33 +622,30 @@ func main() {
 		}
 	}()
 
+	// The monitor UI (/, /api/*, /chrome.log) is open — the Space is private, so
+	// HuggingFace's own auth already gates who can reach it (the owner). The browser
+	// can't attach ?key= when HF serves the private subdomain, so requiring our key
+	// here locks the owner out of their own live view. Only the AI gateway
+	// (/gpt /gemini /flow) and /logs stay API-key-gated for external programmatic use.
 	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/" {
 			http.NotFound(w, r)
 			return
 		}
-		if !authOK(w, r) {
-			return
-		}
-		// If the key arrived via ?key=, persist it as a cookie so the in-page
-		// /api/* fetches (same origin) stay authorized without re-passing it.
-		if k := r.URL.Query().Get("key"); k != "" && k == apiKey {
-			http.SetCookie(w, &http.Cookie{Name: "apikey", Value: k, Path: "/", HttpOnly: true, SameSite: http.SameSiteStrictMode})
-		}
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
 		w.Write(indexHTML)
 	})
-	http.HandleFunc("/api/tabs", gate(tabsHandler))
-	http.HandleFunc("/api/screen", gate(screenHandler))
-	http.HandleFunc("/api/input", gate(inputHandler))
-	http.HandleFunc("/api/navigate", gate(navigateHandler))
-	http.HandleFunc("/api/reload", gate(reloadHandler))
-	http.HandleFunc("/api/back", gate(historyHandler(-1)))
-	http.HandleFunc("/api/forward", gate(historyHandler(+1)))
-	http.HandleFunc("/api/newtab", gate(newtabHandler))
-	http.HandleFunc("/api/closetab", gate(closetabHandler))
-	http.HandleFunc("/api/stats", gate(statsHandler))
-	http.HandleFunc("/chrome.log", gate(chromeLogHandler))
+	http.HandleFunc("/api/tabs", tabsHandler)
+	http.HandleFunc("/api/screen", screenHandler)
+	http.HandleFunc("/api/input", inputHandler)
+	http.HandleFunc("/api/navigate", navigateHandler)
+	http.HandleFunc("/api/reload", reloadHandler)
+	http.HandleFunc("/api/back", historyHandler(-1))
+	http.HandleFunc("/api/forward", historyHandler(+1))
+	http.HandleFunc("/api/newtab", newtabHandler)
+	http.HandleFunc("/api/closetab", closetabHandler)
+	http.HandleFunc("/api/stats", statsHandler)
+	http.HandleFunc("/chrome.log", chromeLogHandler)
 	http.HandleFunc("/logs/", backendLogHandler)
 
 	// API gateway → the three backend servers on localhost (API-key gated).