fix(api): require auth for sensitive reads

[frahlg]

Summary

• Protect backup listing, backup downloads, and managed CalDAV credentials with the shared API security guard.
• Keep token-free access for local LAN clients; remote clients and public/FQDN hosts must send the configured Bearer token.
• Cover GET and HEAD requests with regression tests and add a patch changeset.

Why

Backup archives contain persistent state and configuration, while the CalDAV credentials endpoint returns a reusable password. Remote requests could read these values without the API token.

Root cause

The shared guard treated almost every GET and HEAD request as an ordinary read. These secret-bearing routes therefore skipped its Host, Origin, fetch-metadata, and remote-token checks.

Checks

• go test ./internal/api -count=1
• make verify
• Pre-push make verify-all, including Linux arm64/amd64 and Windows amd64 builds