fix: prevent express.static from serving index.html on /

express.static was intercepting GET / and serving the SPA before
the route handlers could check auth. Use { index: false } so only
JS/CSS/assets are served statically; index.html routing is handled
explicitly by /editor and the catch-all.

Made-with: Cursor

backend/src/server.ts

@@ -292,7 +292,8 @@ function sendLoginPage(res: express.Response) {
 }
 
 if (existsSync(staticDir)) {
-  app.use(express.static(staticDir));
+  // Serve JS/CSS/assets but NOT index.html (routing handles that)
+  app.use(express.static(staticDir, { index: false }));
 
   // GET /editor → requires auth, serves the SPA
   app.get("/editor", async (req, res) => {