add ZERO_MUTATE_URL and no-op mutate endpoint for zero-cache auth passthrough

docker/.env.example

@@ -85,13 +85,20 @@ EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
 # ZERO_CVR_DB=postgresql://surfsense:surfsense@db:5432/surfsense
 # ZERO_CHANGE_DB=postgresql://surfsense:surfsense@db:5432/surfsense
 
-# URL where zero-cache sends queries for resolution (server-to-server).
+# ZERO_QUERY_URL: where zero-cache forwards query requests for resolution.
-# Default: http://frontend:3000/api/zero/query (Docker service networking).
+# ZERO_MUTATE_URL: required by zero-cache when auth tokens are used, even though
+#   SurfSense does not use Zero mutators. Setting both URLs tells zero-cache to
+#   skip its own JWT verification and let the app endpoints handle auth instead.
+#   The mutate endpoint is a no-op that returns an empty response.
+# Default: Docker service networking (http://frontend:3000/api/zero/...).
 # Override when running the frontend outside Docker:
 #   ZERO_QUERY_URL=http://host.docker.internal:3000/api/zero/query
+#   ZERO_MUTATE_URL=http://host.docker.internal:3000/api/zero/mutate
 # Override for custom domain:
 #   ZERO_QUERY_URL=https://app.yourdomain.com/api/zero/query
+#   ZERO_MUTATE_URL=https://app.yourdomain.com/api/zero/mutate
 # ZERO_QUERY_URL=http://frontend:3000/api/zero/query
+# ZERO_MUTATE_URL=http://frontend:3000/api/zero/mutate
 
 # ------------------------------------------------------------------------------
 # Database (defaults work out of the box, change for security)

docker/docker-compose.dev.yml

@@ -185,6 +185,7 @@ services:
       - ZERO_REPLICA_FILE=/data/zero.db
       - ZERO_ADMIN_PASSWORD=${ZERO_ADMIN_PASSWORD:-surfsense-zero-admin}
       - ZERO_QUERY_URL=${ZERO_QUERY_URL:-http://frontend:3000/api/zero/query}
+      - ZERO_MUTATE_URL=${ZERO_MUTATE_URL:-http://frontend:3000/api/zero/mutate}
     volumes:
       - zero_cache_data:/data
     restart: unless-stopped

docker/docker-compose.yml

@@ -171,6 +171,7 @@ services:
       ZERO_REPLICA_FILE: /data/zero.db
       ZERO_ADMIN_PASSWORD: ${ZERO_ADMIN_PASSWORD:-surfsense-zero-admin}
       ZERO_QUERY_URL: ${ZERO_QUERY_URL:-http://frontend:3000/api/zero/query}
+      ZERO_MUTATE_URL: ${ZERO_MUTATE_URL:-http://frontend:3000/api/zero/mutate}
     volumes:
       - zero_cache_data:/data
     restart: unless-stopped

surfsense_web/app/api/zero/mutate/route.ts

@@ -0,0 +1,5 @@
+import { NextResponse } from "next/server";
+
+export async function POST() {
+	return NextResponse.json([]);
+}