fix: robustify analytics handlers and fix auth middleware scope

Moved AuthMiddleware to /v1 group only. Added COALESCE and empty result handling to analytics SQL queries to prevent 500 errors on empty databases.

internal/server/server.go

@@ -74,7 +74,8 @@ func NewServer(cfg *config.Config, database *db.DB) *Server {
 }
 
 func (s *Server) setupRoutes() {
-	s.router.Use(middleware.AuthMiddleware(s.database))
+	// Global middleware should only be for logging/recovery
+	// Auth is specific to groups
 
 	// Static files
 	s.router.StaticFile("/", "./static/index.html")
@@ -86,7 +87,9 @@ func (s *Server) setupRoutes() {
 	// WebSocket
 	s.router.GET("/ws", s.handleWebSocket)
 
+	// API V1 (External LLM Access)
 	v1 := s.router.Group("/v1")
+	v1.Use(middleware.AuthMiddleware(s.database))
 	{
 		v1.POST("/chat/completions", s.handleChatCompletions)
 		v1.GET("/models", s.handleListModels)