fix: bypass dashboard auth on HF Spaces

src/middleware/dashboard-auth.ts

@@ -30,6 +30,9 @@ export async function dashboardAuth(c: Context, next: Next): Promise<Response |
   // No key configured → no gate
   if (!config.server.proxy_api_key) return next();
 
+  // HF Spaces → bypass (reverse proxy makes localhost detection unreliable)
+  if (process.env.HF_SPACE_ID || process.env.SPACES) return next();
+
   // Localhost → bypass (Electron + local dev)
   const remoteAddr = getConnInfo(c).remote.address ?? "";
   if (isLocalhostRequest(remoteAddr)) return next();