fix: allow public access to static files in moderation service (#397)

the auth middleware was blocking /static/* paths, causing 401 on CSS/JS
files needed for the admin UI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <[e-mail]>

moderation/src/auth.rs

···
 
     // Public endpoints - no auth required
     // Note: /admin serves HTML, auth is handled client-side for API calls
+    // Static files must be public for admin UI CSS/JS to load
     if path == "/"
         || path == "/health"
         || path == "/admin"
+        || path.starts_with("/static/")
         || path.starts_with("/xrpc/com.atproto.label.")
     {
         return Ok(next.run(req).await);