Merged in feature/permit-policy-cleanup (pull request #210)

cleanup permit policies and correct documentation

* docs

* policy cleanup

* refactor

* Merge remote-tracking branch 'origin/feature/permit-policy-cleanup' into feature/permit-policy-cleanup

* docs and edits

docs/ai.generated/queryapi.summary.md

@@ -365,9 +365,15 @@ Rate limit headers included in all responses:
 
 - **Authentication**: JWT Bearer tokens via AWS Cognito OAuth2
 - **Authorization**: Role-based access control (RBAC) via Permit.io
-- **All endpoints require authentication** except:
+- **Public endpoints** (no authentication required):
   - `GET /login` - Public login initiation
   - `GET /login-callback` - OAuth2 callback handler
+  - `GET /home` - Home/menu page
+  - `GET /logout` - Logout redirect flow
+  - `GET /health` - Health check
+  - `GET /swagger/*` - Swagger UI
+  - `GET /metrics` - Prometheus metrics
+  - `GET /eula` - Current public EULA version
 
 ## API Versioning