Added /error in SecurityConfig.java

[AnUbH75]

Summary

Adds /error to SecurityConfig's permitAll() matcher list, and consolidates the app's unauthenticated path prefixes into a single shared PublicPaths class referenced by both JwtAuthFilter and SecurityConfig, so the two can no longer drift apart.

Without the /error fix, an anonymous request to /api/public/secure-sends/{token} for an unknown, expired, or revoked token had its real response (404/410 from SecureSendService.resolve()) silently replaced during Spring's internal /error re-dispatch, surfacing as a bare 403 instead.

While verifying this fix end-to-end, found JwtAuthFilter's own hardcoded skip-list was separately out of sync with SecurityConfig's permitAll() list in two more places: the /s/{token} short-link route (introduced with the public-base-url fix) and /docs/**//ws-chat/**, both permitted in SecurityConfig but still rejected with 401 by the filter. Fixed by extracting one shared PublicPaths.PREFIXES list that both classes now derive from.

The filter-level part of #109 (JwtAuthFilter skipping /api/public/) and the permitAll entry for /api/public/secure-sends/** were already present on main prior to this change (landed with #104). This PR addresses the /error gap the issue explicitly called out, plus the follow-on drift bugs found while verifying it.

Linked issue

Closes #109

How to test

1. Start the backend locally.
2. Unknown token, no auth header:

   curl -i http://localhost:8090/api/public/secure-sends/not-a-real-token
   

   Before: 403 empty body. After: 404 with body Secure Send link is unavailable.
3. Genuinely protected route still requires auth:

   curl -i http://localhost:8090/api/secure-sends
   

   Still 401.
4. /s/{token} short link (with cloudpage.share.public-base-url pointed at the frontend): no longer 401s at the filter.
5. /docs/** and /ws-chat/**: no longer 401 for anonymous requests.
6. Docs still reachable: /v3/api-docs, /swagger-ui/index.html → 200.

Notes / Risk

• Low risk: consolidates existing public-path entries into one source; no new paths made public beyond what SecurityConfig already declared.
• No automated test added — existing SecureSendControllerTest runs with addFilters = false, which bypasses the exact filter/permitAll interaction these fixes address. Verified manually via curl instead (above); flagging as a possible follow-up if a dedicated @SpringBootTest is wanted.
• Confirmed the fix doesn't over-widen access: protected routes still correctly 401 anonymous requests.

[AnUbH75]

@DenizAltunkapan please have a look on did a few changes, but things are working well on local

[DenizAltunkapan]

@AnUbH75 thanks!