fix: serve /settings without auth header — JS handles token check

api/router.py

@@ -280,11 +280,9 @@ async def create_combined_source(body: dict, user: dict = Depends(current_user))
 
 
 @router.get("/settings")
-async def settings_page_route(user: dict = Depends(current_user)):
-    from fastapi.responses import FileResponse, RedirectResponse
+async def settings_page_route():
+    from fastapi.responses import FileResponse
     from pathlib import Path
-    if not user.get("is_admin"):
-        return RedirectResponse("/")
     return FileResponse(str(Path(__file__).parent.parent / "frontend" / "settings.html"))