fix: public footer reads DB settings for all visitors

- settings.js: new public GET /settings/public returns only
  copyright + icp (no auth, no sensitive settings leaked)
- app.js loadFooter(): dropped Auth.isAdmin() gate, uses public
  endpoint; showPublic() (home/root) now loads footer too
- security.js: apiKeyGuard whitelist /api/settings/public and
  /api/settings/skin-site

backend/middleware/security.js

@@ -154,7 +154,7 @@ const captchaLimiter = rateLimit({
 
 function apiKeyGuard(req, res, next) {
   const p = req.originalUrl;
-  if (p === '/api/health' || p.startsWith('/api/install') || p.startsWith('/api/polls/server-list')) return next();
+  if (p === '/api/health' || p.startsWith('/api/install') || p.startsWith('/api/polls/server-list') || p.startsWith('/api/settings/public') || p.startsWith('/api/settings/skin-site')) return next();
   const key = getApiKey();
   if (!key) return next();
   if (!req.headers['x-api-key'] || req.headers['x-api-key'].length !== key.length) return res.status(401).json({ error: '无效的 API 密钥' });