remove .well-known/ from Tinfoil attestation routing

Tinfoil's proxy server guide only requires /attestation (GET) and
/v1/chat/completions + /v1/responses (POST). The .well-known/ path was
never requested by Tinfoil and was incorrectly added to:
- _API_PATH_PREFIXES (prefix gate)
- the unauthenticated GET bypass branch
- the Tinfoil integration docs

Remove it from all three.

docs/tinfoil-direct-integration.md

@@ -410,8 +410,8 @@ and `routstr/upstream/ehbp.py`.
   - `forward_ehbp_x_cashu_request()`: if usage is available, computes the
     refund from actual cost instead of max cost.
 
-- `routstr/proxy.py`: `/attestation` and `/.well-known/` paths are forwarded
-  to all enabled upstreams without model/cost/auth lookups.
+- `routstr/proxy.py`: `/attestation` and `/tee/attestation` paths are forwarded
+  to Tinfoil upstreams without model/cost/auth lookups.
 
 ### Billing behavior
 

routstr/proxy.py

@@ -191,7 +191,6 @@ _API_PATH_PREFIXES = (
     "providers",
     "tee/",
     "attestation",
-    ".well-known/",
 )
 
 
@@ -234,14 +233,12 @@ async def proxy(
         else:
             model_id = request_body_dict.get("model", "unknown")
 
-    # /tee/*, /attestation and /.well-known/* GET requests don't map to models
-    # — forward without model/cost/auth lookups. Tinfoil attestation paths are
-    # routed only to Tinfoil providers so an unrelated upstream's 404 cannot
+    # /tee/* and /attestation GET requests don't map to models — forward
+    # without model/cost/auth lookups. Tinfoil attestation paths are routed
+    # only to Tinfoil providers so an unrelated upstream's 404 cannot
     # short-circuit before the attestation proxy is tried.
     if request.method == "GET" and (
-        path.startswith("tee/")
-        or path.startswith("attestation")
-        or path.startswith(".well-known/")
+        path.startswith("tee/") or path.startswith("attestation")
     ):
         selected_upstreams = _select_unauthenticated_get_upstreams(path, _upstreams)
         if not selected_upstreams: