refactor(api): switch to header-based auth for GET requests

- Replace body parsing with header validation for GET endpoints
- Update router to properly handle GET vs POST requests
- Add new ValidateRequestWithHeader function
- Update README to document header requirements

frpc.go

@@ -433,14 +433,7 @@ func ListInstancesHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		SendErrorResponse(w, http.StatusBadRequest, "failed to read request body")
-		return
-	}
-	defer r.Body.Close()
-
-	userID, _, err := ValidateRequestWithBody(w, r, body)
+	userID, _, err := ValidateRequestWithHeader(w, r)
 	if err != nil {
 		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
 		return