Mark custom routes public without turning off auth

We added AuthorizationConfig.excluded_route_paths. List the custom routes you want to leave open and they skip auth, while the rest of your AgentOS stays protected. Before this, making a single route public meant disabling authorization globally.

Learn more with cookbook.