fix(api): add whoami to allowed endpoints whitelist

The /whoami endpoint was missing from the proxy whitelist, causing
403 errors when validating API keys on the Vercel-hosted instance.

Author: msujaws

api/bugzilla.test.ts

@@ -185,6 +185,20 @@ describe('Bugzilla API Proxy Security', () => {
       expect(fetch).toHaveBeenCalled()
     })
 
+    it('should allow /whoami endpoint', async () => {
+      const req = createMockRequest({
+        url: '/api/bugzilla/whoami',
+        query: { path: ['whoami'] },
+        headers: { origin: 'http://localhost:5173' },
+      })
+      const res = createMockResponse()
+
+      await handler(req, res)
+
+      expect(res._status).not.toBe(403)
+      expect(fetch).toHaveBeenCalled()
+    })
+
     it('should reject unauthorized endpoints', async () => {
       const req = createMockRequest({
         url: '/api/bugzilla/admin/settings',

api/bugzilla.ts

@@ -12,7 +12,7 @@ const ALLOWED_ORIGINS = [
 ]
 
 // Allowed endpoint prefixes - whitelist only safe endpoints
-const ALLOWED_ENDPOINTS = new Set(['bug', 'user'])
+const ALLOWED_ENDPOINTS = new Set(['bug', 'user', 'whoami'])
 
 function isOriginAllowed(origin: string | undefined): boolean {
   // Same-origin requests (no origin header) are allowed