b820e690f0
The global Auth middleware allowlist (noAuthAPI) was missing the share-link routes, so an unauthenticated invitee opening /register?token= hit a 401 on /auth/invitations/lookup and the frontend bounced them to /login instead of showing the register page. Add both share-link endpoints to the allowlist and stop the request interceptor from treating their 401s as a session-expiry redirect. Refs: https://github.com/Tencent/WeKnora/issues/1617