GET /status needs no API key and returns the end of the last answer #212

With an API key configured, /v1/*, /slots, /props, /metrics, /settings and /mcp answer 401 without it, and docs/DETAILS.md says the metadata endpoints and /slots require the key. GET /status (serve/server.py#L1312-L1323) does not check it, and its answer includes tail, the last 600 characters of the generated text (#L781), and tool, the tool being called. tail is not cleared when the request ends (#L916 resets only busy), so /status keeps returning the end of the most recent answer while the server is idle.

So anything that can reach the port can read the model's output without the key: every local process on the default 127.0.0.1, and the network with --host 0.0.0.0.

Reproduce (v0.1.27, a790805, mock engine)

python serve/server.py --engine mock --port 18095 --api-key secret \
  --script $'</think>\n\nThe meeting moved to Thursday; the door code is 4417.'

curl -s http://127.0.0.1:18095/v1/chat/completions -H 'Authorization: Bearer secret' \
  -H 'Content-Type: application/json' -d '{"model": "x", "messages": [{"role": "user", "content": "hi"}], "max_tokens": 64}'

curl -s http://127.0.0.1:18095/status     # no key
curl -s http://127.0.0.1:18095/slots      # no key

After the request has finished, /status without the key returns:

{"busy": false, "queued": 0, "phase": "answering", "prompt_tokens": 246, "generated": 63, "tool": null, "tail": "The meeting moved to Thursday; the door code is 4417.", "max_tokens": 64}

/slots, /v1/status and /v1/models without the key return 401 missing or wrong API key.

Suggested fix

Require the key on /status as on /slots (nothing in serve/web reads /status), or keep it open without tail and tool. Clearing tail when a request ends would also stop it from outliving the request.