Fix CRITICAL auth bypass: exact match for login/signup paths

startsWith('/api/v1/auth/login') allowed any path with that prefix
to bypass authentication (e.g. /api/v1/auth/login-anything).
Changed to exact path match with query string stripping.
Fixed across all 5 products + shared/auth.ts.

products/03-alert-intelligence/src/auth/middleware.ts

@@ -27,7 +27,8 @@ export function registerAuth(app: FastifyInstance, jwtSecret: string, pool: Pool
     if (req.url === '/health' || req.url === '/version') return;
     if (req.url.startsWith('/webhooks/')) return;
     if (req.url.startsWith('/slack/')) return;
-    if (req.url.startsWith('/api/v1/auth/login') || req.url.startsWith('/api/v1/auth/signup')) return;
+    const path = req.url.split('?')[0];
+    if (path === '/api/v1/auth/login' || path === '/api/v1/auth/signup') return;
 
     const apiKey = req.headers['x-api-key'] as string | undefined;
     const authHeader = req.headers['authorization'];