Fix excluded_paths dropped by sanitize functions during creation

The sanitizeAuthentikMeta and sanitizeCpmForwardAuthMeta functions
did not process excluded_paths, causing the field to be silently
stripped when creating a proxy host.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/lib/models/proxy-hosts.ts

@@ -402,6 +402,13 @@ function sanitizeAuthentikMeta(meta: ProxyHostAuthentikMeta | undefined): ProxyH
     }
   }
 
+  if (Array.isArray(meta.excluded_paths)) {
+    const paths = meta.excluded_paths.map((path) => path?.trim().replace(/\{[^}]*\}/g, "")).filter((path): path is string => Boolean(path));
+    if (paths.length > 0) {
+      normalized.excluded_paths = paths;
+    }
+  }
+
   return Object.keys(normalized).length > 0 ? normalized : undefined;
 }
 
@@ -581,6 +588,12 @@ function sanitizeCpmForwardAuthMeta(meta: CpmForwardAuthMeta | undefined): CpmFo
       normalized.protected_paths = paths;
     }
   }
+  if (Array.isArray(meta.excluded_paths)) {
+    const paths = meta.excluded_paths.map((p) => p?.trim().replace(/\{[^}]*\}/g, "")).filter((p): p is string => Boolean(p)); // codeql[js/polynomial-redos] false positive: [^}]* is linear, no backtracking ambiguity
+    if (paths.length > 0) {
+      normalized.excluded_paths = paths;
+    }
+  }
   return Object.keys(normalized).length > 0 ? normalized : undefined;
 }