feat(auth): harden Authentik and guest capability boundaries

backend/app/main.py

@@ -26,7 +26,7 @@ from app.services.aoi_operation_worker import AoiOperationWorker
 
 logger = logging.getLogger("geointel")
 SAFE_REQUEST_ID = re.compile(r"^[A-Za-z0-9._:-]{1,128}$")
-UNSAFE_HOST = re.compile(r"[/\\@\s\x00-\x1f\x7f]")
+UNSAFE_HOST = re.compile(r"[/\\@?#\s\x00-\x1f\x7f]")
 
 
 def _to_error_payload(
@@ -157,6 +157,8 @@ def create_app() -> FastAPI:
                 f"{settings.api_prefix}/auth/login",
                 f"{settings.api_prefix}/auth/guest",
                 f"{settings.api_prefix}/auth/logout",
+                f"{settings.api_prefix}/auth/authentik/start",
+                f"{settings.api_prefix}/auth/authentik/callback",
             }
             direct_loopback_request = (
                 request.client is not None
@@ -261,6 +263,7 @@ def create_app() -> FastAPI:
                         guest_safe_post_paths = {
                             f"{settings.api_prefix}/demo/workflow",
                             f"{settings.api_prefix}/external/coverage/resolve",
+                            f"{settings.api_prefix}/analysis/change-detection",
                         }
                         guest_scoped_analysis_post_paths = {
                             f"{settings.api_prefix}/detection/run",
@@ -274,7 +277,10 @@ def create_app() -> FastAPI:
                             f"{settings.api_prefix}/exports/map-result",
                         }
                         guest_safe_post_suffixes = (
+                            "/acquire",
                             "/vector/select",
+                            "/vector/select/derive",
+                            "/raster/tile",
                             "/raster/bathymetry/select",
                             "/raster/terrain/select",
                             "/raster/flood-hazard/select",
@@ -313,7 +319,7 @@ def create_app() -> FastAPI:
                                 status_code=403,
                                 content=_to_error_payload(
                                     "GUEST_READ_ONLY",
-                                    "Gasttoegang is een tijdelijke, alleen-lezen demo. Meld u aan als operator om gegevens te wijzigen of taken te starten.",
+                                    "Gasttoegang laat alleen projectgebonden demo-analyses toe. Meld u aan als operator voor beheerwijzigingen.",
                                     request_id=request_id,
                                 ),
                             )