The /network-backup and /network-backup-files routes use their own X-Network-Backup-Key authentication. Mounting them behind authenticateJWT blocked all receiver sync requests before they could be validated. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>