fix(control): allow login when HTTP server is stopped

Mount auth routes on the control plane and proxy /api/auth to :8600 in
dev:pm2 so the UI can authenticate while the HTTP API process is down.

Co-authored-by: Cursor <cursoragent@cursor.com>

packages/server/control.js

@@ -4,7 +4,7 @@ import cors from "@fastify/cors";
 import jwt from "@fastify/jwt";
 import { migrate, db } from "./db.js";
 import { log, enableLogPersistence, flushLogs } from "./logger.js";
-import { COOKIE } from "./src/api/auth.js";
+import authPlugin, { addApiAuthGuard, COOKIE } from "./src/api/auth.js";
 import {
   clearRestartNeeded,
   bumpGeneration,
@@ -124,6 +124,14 @@ server.decorate("requireAdmin", async function requireAdmin(req, reply) {
   }
 });
 
+await server.register(
+  async (api) => {
+    addApiAuthGuard(api, server);
+    await api.register(authPlugin);
+  },
+  { prefix: "/api" },
+);
+
 /**
  * @param {number} timeoutMs
  * @param {string} lockToken