fix(questionnaires): fix public vendor form failing to load

[AndreLiar]

Summary

• publicApiBaseURL appended /api/v1 onto NEXT_PUBLIC_API_URL, which already contains it, producing a double-prefixed /api/v1/api/v1/... request that 404s for the vendor-facing /q/:token form.
• requireActivePlan was applied to the whole /api/v1/questionnaires mount, including the public /respond/:token routes. When the visiting browser carries a session cookie (e.g. the workspace owner previewing their own generated link from a paused/past_due org), this returned 402 on a route that's supposed to be reachable by vendors with no Retrieva account at all.
• Moved the two /respond/:token routes into a new questionnairePublicRoutes.js, mounted unguarded in app.js ahead of optionalAuth/requireActivePlan, matching the existing "unguarded" pattern for auth/organizations/billing.

Fixes the reported error on https://retrieva.online/q/<token>: "Unable to load questionnaire. Please try again."

Test plan

• npx vitest run tests/unittest/questionnaireController.test.js — 33 passed
• npx vitest run src/tests/questionnaires-api.test.ts (frontend) — 23 passed
• Full backend suite (1449) + frontend suite (521) — all pass (pre-push hook)
• Local stack (docker compose up -d): created a real questionnaire, sent it for a token, then via Playwright on http://localhost:3000/q/<token>:
  • GET /api/v1/questionnaires/respond/<token> → 200, form renders with real DORA questions
  • POST /api/v1/questionnaires/respond/<token> (Save & Continue) → 200, partial answer persisted in MongoDB
• Confirmed the old double-prefix path /api/v1/api/v1/questionnaires/respond/<token> now 404s (vs 402)
• Confirmed an authenticated user whose org planStatus=paused still gets 200 on the public form, while other paid routes (e.g. /workspaces) correctly still 402

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!