fix(auth): exact-match open paths for engine/status, metrics/inference, smtp/probe

_is_open_path() excludes exact prefix equals by design (health needed its own
_OPEN_EXACT entry); the new ops + worker routes are exact equals, so they were
still license-gated. Add them to _OPEN_EXACT — worker probes keep their own
X-Worker-Token guard.

app/auth.py

@@ -145,7 +145,16 @@ _OPEN_PREFIXES = (
     "/redoc",
     "/openapi.json",
 )
-_OPEN_EXACT = frozenset({"/", "/api/v1/health", "/api/health"})
+_OPEN_EXACT = frozenset(
+    {
+        "/",
+        "/api/v1/health",
+        "/api/health",
+        "/api/v1/engine/status",
+        "/api/v1/metrics/inference",
+        "/api/v1/smtp/probe",
+    }
+)
 
 
 def _is_open_path(path: str) -> bool: