Fix static fast path and public trial preflight

[matveynator]

Summary

• Skip database-backed alias and stealth lookups for guest static requests so published pages stay on the database-free fast path.
• Let public trial endpoints reach their CORS preflight handler without the admin stealth check.

Validation

• CGO_ENABLED=0 GOCACHE=/private/tmp/sitebrush-gocache go test . -run '^(TestPublicTrialEndpointsAllowCredentialFreeCrossOriginEmbedding|TestGuestStaticRouteServesPublishedFileWithoutDatabase|TestGuestStaticAnalyticsAvoidsDatabaseAndEnqueuesEvent)$' -count=1
• git diff --check

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7013468f65

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep stealth filtering on guest static requests

When stealth mode is enabled and an unallowlisted address performs an ordinary GET/HEAD without a session or query string, this condition now skips serveStealthStaticForBlockedAdminIP. The subsequent static fast path calls servePublishedStaticFileFromDisk(..., true), injecting the SiteBrush login/context-menu UI that stealth mode explicitly removes; TestBlockedAdminIPSeesStaticSiteAndNoSiteBrushRoutes now fails on this behavior. It also lets a request such as /_sitebrush/analytics reach the internal handler instead of appearing as a missing static path.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Resolve aliases before handling crawler discovery files

For a guest request through a verified alias, this leaves requestDomain set to the alias rather than its primary domain. serveDefaultCrawlerIndex then looks for static files and queries published_pages and page_password_rules using that alias and returns before the later siteDomain resolution, so /robots.txt and /sitemap.xml can be replaced by generated output with missing protected-path directives or an empty page list instead of the primary site's published discovery files.

Useful? React with 👍 / 👎.