P7 r8 fixes: lazy mounts catch ProviderNotActiveError (503 not 500), wg redeem added to PUBLIC_ROUTES (redemption is sessionless), live-curl probe script

dashcaddy-api/src/utilities/middleware.js

@@ -403,6 +403,10 @@ module.exports = function configureMiddleware(app, {
     // gate would deadlock every protected site. Prefix (trailing slash)
     // covers GET + POST on the canonical /network/forward-auth/ URI.
     { path: '/api/v1/network/forward-auth/', prefix: true },
+    // DC-150: WG invite redemption — the redeemer has NO DashCaddy session
+    // (they got a link/QR). The token itself is the credential; the redeem
+    // route validates it. Without this the redemption page 401s at the gate.
+    { path: '/api/v1/network/wg/redeem/', prefix: true },
     { path: '/api/v1/auth/app-token/',   prefix: true },
     { path: '/api/v1/auth/login-page',   exact: true,  method: 'GET' },
     // Must be public: a fresh cross-subdomain visitor has no session yet by