fix(auth): закрыть обход JWT через закодированные URL

docs/ux-ui/acceptance/auth211-baseline-live-2026-10-13.json

@@ -0,0 +1,30 @@
+{
+  "date": "2026-10-13",
+  "block": "12.5.211",
+  "runtime": "ux-gre209",
+  "cases": [
+    {
+      "path": "/api/servers",
+      "status": 401,
+      "anonymous": true,
+      "serverRows": 0,
+      "nonemptyPasswordPresent": false
+    },
+    {
+      "path": "/api/%73ervers",
+      "status": 401,
+      "anonymous": true,
+      "serverRows": 0,
+      "nonemptyPasswordPresent": false
+    },
+    {
+      "path": "/%61pi/servers",
+      "status": 200,
+      "anonymous": true,
+      "serverRows": 2,
+      "nonemptyPasswordPresent": true
+    }
+  ],
+  "rawBodyStored": false,
+  "mutationRequests": 0
+}