fix: harden launch server runtime and public config

src/routes/public.js

@@ -36,14 +36,50 @@ function registerPackageRoutes(router) {
 function registerHealthRoutes(router) {
   // ── Health ───────────────────────────────────────────────────────────
 
+  // Public health: minimal response, no provider/key details exposed
   router.get("/health", async (_req, res) => {
+    res.json({ status: "ok", uptime: process.uptime() });
+  });
+
+  // Admin-only health: full provider status (requires auth via admin middleware)
+  router.get("/admin/providers/status", async (_req, res) => {
     const status = await keyManager.getAllStatus();
     res.json({ status: "ok", uptime: process.uptime(), providers: status });
   });
 }
 
+
+const PUBLIC_CONFIG_PROFILES = new Set(["web-public-config", "web-model-capabilities"]);
+
+function createPublicConfigFallback(name) {
+  if (name === "web-model-capabilities") {
+    return {
+      imageModels: [],
+      videoModels: [],
+      chatModels: [],
+    };
+  }
+  return {};
+}
+
+function registerPublicConfigRoutes(router) {
+  router.get("/public/config/profile", async (req, res) => {
+    const name = String(req.query.name || "web-public-config").trim() || "web-public-config";
+    if (!PUBLIC_CONFIG_PROFILES.has(name)) return res.status(404).json({ error: "Public config profile not found" });
+    const { rows: [row] } = await pool.query(
+      "SELECT config_json, description, updated_at FROM config_profiles WHERE name = $1",
+      [name],
+    );
+    if (!row) return res.json({ name, config: createPublicConfigFallback(name), description: "", updatedAt: null });
+    let config = {};
+    try { config = JSON.parse(row.config_json || "{}"); } catch {}
+    return res.json({ name, config, description: row.description || "", updatedAt: row.updated_at });
+  });
+}
+
 module.exports = {
   registerPriceRoutes,
   registerPackageRoutes,
+  registerPublicConfigRoutes,
   registerHealthRoutes,
 };