fix: block sensitive API routes from external access when TOTP off

Add sensitiveRouteMiddleware that blocks /api/v1/config, /api/v1/tailscale/status,
/api/v1/tailscale/devices, /api/v1/updates/available when TOTP is disabled and
the request comes from a non-Tailscale IP. This prevents infrastructure detail
leaks on internet-exposed deployments.

Verified on test.dashcaddy.net: all 3 routes now return 403.

dashcaddy-api/src/utilities/middleware.js

@@ -504,6 +504,33 @@ module.exports = function configureMiddleware(app, {
     return errorResponse(res, 401, '[DC-110] Authentication required', { requiresTotp: true });
   };
 
+
+  // ── Sensitive routes: block external access when TOTP is off ──
+  // When TOTP is not enabled, all routes are open by design. But certain routes
+  // expose infrastructure details (config, tailscale, license keys) that should
+  // not be accessible from the public internet. Block these from non-Tailscale IPs.
+  const SENSITIVE_ROUTES = [
+    '/api/v1/config',
+    '/api/v1/tailscale/status',
+    '/api/v1/tailscale/devices',
+    '/api/v1/updates/available',
+  ];
+
+  const sensitiveRouteMiddleware = (req, res, next) => {
+    if (!totpConfig.enabled) {
+      const isSensitive = SENSITIVE_ROUTES.some(r => req.path === r);
+      if (isSensitive && !isTailscaleIP(getClientIP(req))) {
+        return res.status(403).json({
+          success: false,
+          error: 'This endpoint requires TOTP authentication or Tailscale access.'
+        });
+      }
+    }
+    next();
+  };
+
+  app.use(sensitiveRouteMiddleware);
+
   app.use(totpAuthMiddleware);
 
   // ── JWT/API Key authentication middleware ──