Single-academy deployments don't have current_academy bound for
unauthenticated API requests. Fall back to Academy::first() so
/api/v1/app/config works without auth.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>