fix(webui): only route /api/sessions to gateway for Bearer-auth requests

The previous /api/sessions route (commit b0371e0) intercepted ALL
/api/sessions requests, including the WebUI's own session-list calls.
The WebUI (nesquena/hermes-webui) calls GET /api/sessions with cookie
auth to list sessions. My route sent those to the gateway (port 8642)
instead, which returned a different JSON format → the WebUI's JS
didn't recognize the sessions → login loop (POST /api/auth/login → 200,
GET /session/{id} → 200, GET /login?next=... → 200, repeat).

Fix: only route /api/sessions to the gateway when the request carries a
Bearer token (Authorization: Bearer ...). The Android app and other API
clients send Bearer → go to the gateway. The WebUI uses cookies (no
Bearer) → falls through to the WebUI catch-all as before.

health-server.js

@@ -1108,12 +1108,16 @@ const server = http.createServer(async (req, res) => {
 
   // 5b. /api/sessions and /api/sessions/* — Hermes gateway session API.
   // The Android app (rusty4444/hermes-android) and other OpenAI-compatible
-  // clients call these directly on the gateway (port 8642), not through
-  // /v1/. Without this route they hit the WebUI catch-all, which uses a
-  // different auth scheme → 401 "invalid api key".
-  // Gate on Bearer token (same as /v1/*). The WebUI's own /api/* calls use
-  // cookie auth and don't hit /api/sessions, so there's no conflict.
-  if (path === "/api/sessions" || path.startsWith("/api/sessions/")) {
+  // clients call these directly on the gateway (port 8642) with a Bearer
+  // token. The WebUI (nesquena/hermes-webui) ALSO calls /api/sessions but
+  // uses cookie auth (no Bearer). To avoid intercepting the WebUI's own
+  // session calls (which caused a login loop), only route to the gateway
+  // when the request carries a Bearer token. Requests without Bearer fall
+  // through to the WebUI catch-all as before.
+  if (
+    (path === "/api/sessions" || path.startsWith("/api/sessions/")) &&
+    getBearerToken(req)
+  ) {
     if (!isAuthorized(req)) {
       res.writeHead(401, {
         "content-type": "application/json",