fix: middleware publicPaths + /api/internal/users for OA monitor integration

src/app/api/admin/user-roles/route.ts

@@ -65,11 +65,17 @@ export async function GET() {
       fetchRoles(A_URL), fetchRoles(I_URL), fetchRoles(M_URL),
     ])
 
-    const [assetsUsers, issueUsers, monitorUsers] = await Promise.all([
+    // monitor 走 API（DB 被 monitor 进程锁，不可直连），assets/issue 直连 SQLite
+    const [assetsUsers, issueUsers] = await Promise.all([
       getSiteUsers(A_DB, assetsRoles),
       getSiteUsers(I_DB, issueRoles),
-      getSiteUsers(M_DB, monitorRoles),
     ])
+    let monitorUsers: { username: string; display_name: string; role: string }[] = []
+    try {
+      const mRes = await fetch(`${M_URL}/api/internal/users`, { headers: { 'x-internal-key': INTERNAL_KEY }, signal: AbortSignal.timeout(5000) })
+      const mData = await mRes.json()
+      monitorUsers = (mData.users || []).map((u: any) => ({ username: u.username, display_name: u.display_name || u.username, role: monitorRoles.includes(u.role) ? u.role : 'viewer' }))
+    } catch { /* monitor 不可达时使用空列表 */ }
 
     let emails: Record<string, string> = {}
     try {