Fix --default-deny index page 500 when no config file

[RamiNoodle733]

Summary

Fixes a regression where --default-deny --root could return a 500 on index/database pages when no config file is present.

What changed

• Always define the anon_rules CTE in build_allowed_resources_sql() when include_is_private=True
• Use an empty fallback CTE when there are no anonymous permission SQL rules
• Added a regression test that authenticates as root and verifies / and /test_db return 200 (not 500) in default_deny=True mode without config

Testing

• uv run pytest tests/test_default_deny.py -q

Fixes #2644