fix(web): auth gate Ask APIs for Public SaaS

[msukkari]

Fixes SOU-2308

Require authenticated users for the streaming and blocking Ask APIs when EXPERIMENT_ASK_GH_ENABLED is enabled, while preserving anonymous Ask behavior for self-hosted deployments. Centralize the policy and apply it to the MCP HTTP entry point as well.

Validation:

• Web tests: 150 files, 1,508 tests passed
• Production web build passed
• Changed-file ESLint passed

Linear Issue: SOU-2308

  

---

Summary by cubic

Fixes SOU-2308 by requiring authenticated users for the streaming and blocking Ask APIs and MCP HTTP entry point when the Public SaaS experiment is enabled. Anonymous Ask access remains unchanged for self-hosted deployments. The auth check is centralized in checkAskAuthentication and applied to all three entry points, and the CHANGELOG records the change.

^{Written for commit 0653cce. Summary will update on new commits.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}