feat(werkbank): runner queue endpoints + result persistence (WB-05) (#207)

compliance-core/src/auth.rs

@@ -64,11 +64,11 @@ struct Claims {
 const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
 
 /// Path prefixes that bypass JWT validation. The admin sub-router
-/// (`/api/v1/admin/*`) has its own static-bearer middleware and must
-/// not be routed through the customer-JWT path — a Keycloak token
-/// always carries a single tenant_id and would semantically conflict
-/// with cross-tenant admin operations.
-const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
+/// (`/api/v1/admin/*`) and the Werkbank runner API (`/api/v1/werkbank/*`)
+/// have their own static-bearer middleware and must not be routed through the
+/// customer-JWT path — a Keycloak token always carries a single tenant_id and
+/// would semantically conflict with these cross-tenant / machine operations.
+const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/", "/api/v1/werkbank/"];
 
 /// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
 /// and attaches a `TenantContext` extension on success.