website refactor

apps/website/lib/routing/RouteConfig.ts

@@ -326,6 +326,12 @@ export const routeMatchers = {
   requiresRole(path: string): string[] | null {
     logger.info('[RouteConfig] requiresRole check', { path });
     
+    // Public routes never require a role
+    if (this.isPublic(path)) {
+      logger.info('[RouteConfig] Path is public, no role required', { path });
+      return null;
+    }
+    
     if (this.isInGroup(path, 'admin')) {
       // Website session roles come from the API and are more specific than just "admin".
       // Keep "admin"/"owner" for backwards compatibility.