fix: make /api/config and /api/services/status public endpoints

These endpoints must be accessible without TOTP auth for the dashboard
to load site config (TLD, DNS servers, custom logo) and service status
(bulk probe results). Without them, the dashboard shows all services
as OFF and loses custom branding after any session expiry.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dashcaddy-api/middleware.js

@@ -297,6 +297,8 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/themes',            exact: true,  method: 'GET' },
     { path: '/api/license/status',    exact: true,  method: 'GET' },
     { path: '/api/license/feature/',  prefix: true, method: 'GET' },
+    { path: '/api/config',             exact: true,  method: 'GET' },
+    { path: '/api/services/status',    exact: true,  method: 'GET' },
   ];
 
   function isPublicRoute(req) {