predictalot v0.2.1 — require auth on /v1/<type>/models Security patch. Closes a usage-pattern info leak: with auth configured, the per-type GET /v1/<type>/models endpoints shipped in v0.2.0 were missing the Depends(check_bearer) guard and would return the installed model list, loaded state, and last-used timestamps to unauthenticated callers. Now bearer-protected. The /healthz endpoint stays open. Open-auth deployments (PREDICTALOT_ALLOW_NO_AUTH=1 + empty token list) are unaffected.