fix: Fixed endpoint

server/internal/api/handlers.go

@@ -24,8 +24,11 @@ func RegisterRoutes(r *gin.Engine) {
 	r.GET("/update", handleUpdateScript)
 
 	// ESO read endpoint — bearer-token auth, not session auth, so Kubernetes
-	// External Secrets Operator can call it. Returns a group as flat JSON.
-	r.GET("/secrets/:group", secretsReadAuth(), esoGetGroup)
+	// External Secrets Operator can call it. Lives under /api (so the reverse
+	// proxy routes it to the backend) but on a distinct subpath to avoid
+	// colliding with the session-authed GET /api/secrets/:group. Returns a
+	// group as flat JSON.
+	r.GET("/api/secrets/:group/values", secretsReadAuth(), esoGetGroup)
 
 	// Auth endpoints (no session required)
 	r.GET("/auth/login", auth.HandleLogin)