Fix Clerk auth headers leaking onto public API routes

Victor asked to fix misleading x-clerk-auth-reason/token-invalid headers on CommonGrid public API routes. Implement middleware bypass for /api/v1/* and /api/tiles/* before Clerk runs, preserving security + CORS headers; add regression tests; open/merge PR once CI green.