[muse-sweep][Med] Auth gate lives only in do_GET - centralize + P1-01 HEAD adjudication

[mattmre]

Finding (operator + R2-BE, CONFIRMED live). grep -n 'do_HEAD|do_OPTIONS|do_POST|def do_GET' dashboard_server.py -> only do_GET (:1576). P1-01 'HEAD auth bypass :1576' is MIS-FILED as bypass: with no do_HEAD, BaseHTTPRequestHandler returns 501 to everyone (no data). Real residual: the NEXT verb handler added without copying the gate check reopens silently.
Fix: centralize authz in one front-controller path + a test that fails for any new route/handler skipping it (BHK muse-lane lesson 5).
Source: Muse EGV review 2026-09-02.