fix: restore production access by allowing public setup-status

[BigSimmo]

Problem

Visitors on psychiatry.tools (especially mobile Safari) saw a blocking Service unavailable / API unavailable banner. The dashboard calls /api/setup-status on load; in production that route required authentication and returned 401, which the client treated as a full API outage.

Root cause

requireProductionSetupStatusAuth blocked anonymous production requests to /api/setup-status. The dashboard then set apiUnavailable=true, showing the degraded notice and preventing normal public search setup checks from loading.

Fix

• Remove the production auth gate from /api/setup-status — the payload already exposes only non-secret setup posture (no keys or credentials).
• Update the degraded-notice copy on production so it no longer mentions local server setup.
• Update the route test to assert anonymous production access works without leaking secrets.

Verification

• npm run test -- tests/setup-status-route.test.ts — pass
• Confirmed live https://psychiatry.tools/api/setup-status currently returns 401 (will be fixed after deploy)

Deploy note

This needs a production deploy to psychiatry.tools for end users to see the fix.

  

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[BigSimmo]

Superseded by #269 (consolidated platform fixes branch).