Fix: /api/config/model is now public, prevent 401 redirect loop in prod

backend/routes/agent.py

@@ -96,8 +96,8 @@ AVAILABLE_MODELS = [
 
 
 @router.get("/config/model")
-async def get_model(user: dict = Depends(get_current_user)) -> dict:
-    """Get current model and available models."""
+async def get_model() -> dict:
+    """Get current model and available models. No auth required."""
     return {
         "current": session_manager.config.model_name,
         "available": AVAILABLE_MODELS,

frontend/src/components/Layout/AppLayout.tsx

@@ -55,17 +55,18 @@ export default function AppLayout() {
   const [availableModels, setAvailableModels] = useState<Array<{ id: string; label: string }>>([]);
 
   useEffect(() => {
-    (async () => {
-      try {
-        const res = await apiFetch('/api/config/model');
-        if (res.ok) {
-          const data = await res.json();
+    // Use plain fetch (not apiFetch) — this is a public endpoint,
+    // no auth needed, and we don't want 401 handling to trigger redirects.
+    fetch('/api/config/model')
+      .then((res) => (res.ok ? res.json() : null))
+      .then((data) => {
+        if (data) {
           setCurrentModel(data.current);
           setAvailableModels(data.available);
         }
-      } catch { /* ignore */ }
-    })();
-  }, []); // eslint-disable-line react-hooks/exhaustive-deps
+      })
+      .catch(() => { /* ignore */ });
+  }, []);
 
   const handleModelChange = useCallback(async (modelId: string) => {
     try {