Assets under /assets/ are accessible without authentication

### Description

When authentication is enabled, static files served under the `/assets/` path are still accessible without being logged in.

https://domain.dev/assets/

## Problem
This allows unauthenticated access to application assets despite authentication being enabled.

## Expected behavior
All routes should respect authentication when auth is enabled.

## Actual behavior
Requests to `/assets/*` succeed without authentication.

## Additional context
This was observed on a deployment with authentication enabled and verified using a logged-out browser session.

Start by reproducing the logged-out request against /assets/* with authentication enabled, then trace how static assets are served and where authentication is applied. Done means unauthenticated requests to /assets/* are denied when auth is enabled while authenticated access still works, with regression coverage if the project has an existing test path.

Written by the indexing model from the issue text.