Add public icon list endpoint

src/main/kotlin/com/android/trisolarisserver/controller/IconFiles.kt

@@ -0,0 +1,32 @@
+package com.android.trisolarisserver.controller
+
+import org.springframework.beans.factory.annotation.Value
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+import java.nio.file.Files
+import java.nio.file.Paths
+
+@RestController
+@RequestMapping("/icons")
+class IconFiles(
+    @Value("\${storage.icons.png.root:/home/androidlover5842/docs/icons/png}")
+    private val pngRoot: String
+) {
+
+    @GetMapping("/png")
+    fun listPng(): List<String> {
+        val dir = Paths.get(pngRoot)
+        if (!Files.exists(dir) || !Files.isDirectory(dir)) {
+            return emptyList()
+        }
+        Files.newDirectoryStream(dir).use { stream ->
+            return stream
+                .filter { Files.isRegularFile(it) }
+                .map { it.fileName.toString() }
+                .filter { it.lowercase().endsWith(".png") }
+                .sorted()
+                .toList()
+        }
+    }
+}

src/main/kotlin/com/android/trisolarisserver/security/FirebaseAuthFilter.kt

@@ -29,6 +29,7 @@ class FirebaseAuthFilter(
             || path.matches(Regex("^/properties/[^/]+/rooms/[^/]+/images$"))
             || path.matches(Regex("^/properties/[^/]+/room-types$"))
             || (path == "/image-tags" && request.method.equals("GET", true))
+            || path == "/icons/png"
     }
 
     override fun doFilterInternal(

src/main/kotlin/com/android/trisolarisserver/security/SecurityConfig.kt

@@ -30,6 +30,7 @@ class SecurityConfig(
                 it.requestMatchers("/properties/*/rooms/*/images").permitAll()
                 it.requestMatchers("/properties/*/room-types").permitAll()
                 it.requestMatchers(org.springframework.http.HttpMethod.GET, "/image-tags").permitAll()
+                it.requestMatchers("/icons/png").permitAll()
                 it.anyRequest().authenticated()
             }
             .exceptionHandling {