fix: /images/ public (no Bearer auth required)

server.mjs

@@ -556,8 +556,8 @@ await mcpServer.connect(mcpTransport);
 const httpServer = http.createServer(async (req, res) => {
   const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
 
-  // Auth gate — skip /health only
-  if (!url.pathname.startsWith('/health')) {
+  // Auth gate — skip /health and /images/
+  if (!url.pathname.startsWith('/health') && !url.pathname.startsWith('/images/')) {
     const auth = req.headers.authorization || '';
     const expected = `Bearer ${MCP_TOKEN}`;
     if (auth !== expected) {