fix(anubis): accept Anubis's own endpoints before the challenge-all rule

The catch-all path_regex "." policy challenged everything, including
Anubis's own API namespace /.within.website/x/cmd/anubis/*
(make-challenge, pass-challenge, static assets). In whole-request proxy
mode a JS-capable browser POSTs its challenge solution to
pass-challenge and received another challenge page (HTML) instead of the
verification verdict (JSON): the challenge app's fetch failed and the
browser rendered its own error — 'the request filters did not return an
alternative response'. Non-JS clients never POST the solution, so every
curl probe looked green while every human hit a wall.

Accept rule ordered above the catch-all; policy is volume-mounted ro from
this checkout, so the deploy updates it in place.

dankclaw/anubis/policy.json

@@ -5,6 +5,11 @@
       "user_agent_regex": "(?i)^(GPTBot|ChatGPT-User|OAI-SearchBot|CCBot|anthropic-ai|ClaudeBot|Claude-Web|PerplexityBot|PerplexityUser|Google-Extended|Applebot-Extended|Bytespider|Amazonbot|meta-externalagent|DuckAssistBot|cohere-ai|YouBot|KimiBot)",
       "action": "DENY"
     },
+    {
+      "name": "serve anubis own endpoints",
+      "path_regex": "^/\\.within\\.website",
+      "action": "ACCEPT"
+    },
     {
       "name": "challenge everything else",
       "path_regex": ".",