fix: resolve dashboard 401 and 500 errors

Restricted AuthMiddleware to /v1 group to prevent dashboard session interference. Robustified analytics SQL queries with COALESCE to handle empty datasets.

internal/server/dashboard.go

@@ -304,7 +304,7 @@ func (s *Server) handleTimeSeries(c *gin.Context) {
 
 	query := fmt.Sprintf(`
 		SELECT 
-			strftime('%%Y-%%m-%%d', timestamp) as bucket,
+			COALESCE(strftime('%%Y-%%m-%%d', timestamp), 'unknown') as bucket,
 			COUNT(*) as requests,
 			COALESCE(SUM(total_tokens), 0) as tokens,
 			COALESCE(SUM(cost), 0.0) as cost
@@ -444,7 +444,7 @@ func (s *Server) handleDetailedUsage(c *gin.Context) {
 
 	query := fmt.Sprintf(`
 		SELECT 
-			strftime('%%Y-%%m-%%d', timestamp) as date,
+			COALESCE(strftime('%%Y-%%m-%%d', timestamp), 'unknown') as date,
 			COALESCE(client_id, 'unknown') as client,
 			COALESCE(provider, 'unknown') as provider,
 			COALESCE(model, 'unknown') as model,

internal/server/server.go

@@ -74,8 +74,6 @@ func NewServer(cfg *config.Config, database *db.DB) *Server {
 }
 
 func (s *Server) setupRoutes() {
-	s.router.Use(middleware.AuthMiddleware(s.database))
-
 	// Static files
 	s.router.StaticFile("/", "./static/index.html")
 	s.router.StaticFile("/favicon.ico", "./static/favicon.ico")
@@ -86,7 +84,7 @@ func (s *Server) setupRoutes() {
 	// WebSocket
 	s.router.GET("/ws", s.handleWebSocket)
 
-	// API V1 (External LLM Access)
+	// API V1 (External LLM Access) - Secured with AuthMiddleware
 	v1 := s.router.Group("/v1")
 	v1.Use(middleware.AuthMiddleware(s.database))
 	{