Exclude static asset extensions from auth redirect middleware

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/3e1fe3d2-54b1-4eb4-90d2-173a5e95d376

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/middleware/auth.py

@@ -37,6 +37,24 @@ _PUBLIC_PREFIXES: tuple[str, ...] = (
     "/openapi",
 )
 
+# File extensions for static assets that are always publicly accessible
+_STATIC_EXTENSIONS: tuple[str, ...] = (
+    ".ico",
+    ".png",
+    ".jpg",
+    ".jpeg",
+    ".gif",
+    ".svg",
+    ".webp",
+    ".css",
+    ".js",
+    ".woff",
+    ".woff2",
+    ".ttf",
+    ".eot",
+    ".map",
+)
+
 
 class AuthRedirectMiddleware(BaseHTTPMiddleware):
     """
@@ -68,6 +86,8 @@ class AuthRedirectMiddleware(BaseHTTPMiddleware):
             return await call_next(request)
         if any(path.startswith(p) for p in _PUBLIC_PREFIXES):
             return await call_next(request)
+        if any(path.endswith(ext) for ext in _STATIC_EXTENSIONS):
+            return await call_next(request)
 
         # ── 2. Valid session cookie ───────────────────────────────────────────
         token = request.cookies.get(SESSION_COOKIE)