fix: remove 'or True' bypass in AuthorizationMiddleware

[Joshua-Medvinsky]

Problem

The AuthorizationMiddleware contains or True in the signature verification condition, making it always truthy. Combined with the base AppTypeInterface.verify_request_signature() which returns True unconditionally, all POST requests to /api/apps/*/run bypass signature verification. An unauthenticated attacker can invoke any app's run endpoint directly.

Fix

Remove or True from the condition in authorization_middleware.py line 30. This restores the intended behavior: only requests with valid Discord or Slack signatures proceed to verification; other requests pass through without triggering the verification block.

Test Plan

• Existing test suite passes
• Requests without Discord/Slack signatures to /api/apps/*/run are no longer forced into the signature verification block
• Discord and Slack webhook requests with valid signatures still work correctly

Security Note

Severity: Critical — This allows unauthenticated invocation of any LLMStack app endpoint, potentially exposing LLM API keys, user data, and app outputs.

[vercel]

Someone is attempting to deploy a commit to the LLMStack Team on Vercel.

A member of the Team first needs to authorize it.