Expose read-only published-file routes publicly

[connorblack]

Summary

• mark indexnow/key public for anonymous IndexNow ownership verification
• mark llms/txt public so sites can expose /llms.txt to anonymous crawlers
• reject every non-GET request to those route handlers with METHOD_NOT_ALLOWED and status 405 before reading or writing plugin state
• cover anonymous GET access, all exported non-GET methods, protected settings routes, and the public-route allowlist through EmDash's public plugin route dispatcher

Why

These GET routes return publication artifacts intended for external consumers. Without public: true, EmDash returns NOT_FOUND before a public site endpoint can dispatch either route. EmDash route metadata is path-scoped rather than method-scoped, so each published-file handler also enforces GET before generating content or creating an IndexNow key.

The change does not make settings or other admin routes public.

Verification

• npm test (8 files, 91 tests passed)
• npm run typecheck
• git diff --check origin/main...HEAD
• before the guard was added, all eight non-GET cases executed instead of returning 405

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5a24394e91

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve POST compatibility for the documented llms.txt proxy

When a site uses the documented Astro integration in README.md:191-197, its public GET /llms.txt handler calls this plugin route with method: "POST"; this new guard therefore returns 405 before generating the file. Either retain POST support for this read-only plugin API call or update the integration to use a confirmed working GET request, otherwise existing sites following the README lose their llms.txt endpoint.

Useful? React with 👍 / 👎.