#2573 SECURITY.md: which paths answer without the API key (the app's pages, /health, a generated image's URL)

Descrição

**What it changes.** SECURITY.md's API-key bullet said the key "is required on `/v1/*`". `GET /v1/images/files/<name>` (a generated image, with image generation set up) answers without it on purpose: the name is `secrets.token_hex(16)` + `.png` (128 random bits) and is the access, as an OpenAI image URL is (`serve/server.py` `do_GET`, `serve/images.py` `store` / `FILE_NAME`). The bullet now names every path that answers without a key: the web app's pages and files (`/`, `/api-monitor` when on, `/web/*`, `/fonts/*`), `/health` and `/api/health` (and what they tell: the model's name, context size, loaded, pictures / image generation on, whether a key is set) and that image URL.

**What it leaves alone.** The server, and every other line of SECURITY.md. It does not overlap #2564 (the CORS bullet).

**How it was checked.** Every `do_GET` branch with a key set (`_authorized()` or not), and an audit of every route with a key: everything else answers 401. A sub-agent reviewer checked the list against `do_GET` / `do_OPTIONS`; its additions (`/api/health`, `/fonts/*`, the full `/health` contents) are in.

🤖 Generated with [Claude Code](https://claude.com/claude-code)