OfficialBotService posts to /api/bots/official/join-tournament, but
the auth interceptor's protected-endpoint whitelist omitted /api/bots,
so no Authorization header was sent and the request hit the official-
bots service anonymously -> 401.
Add /api/bots to the whitelist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>