Hey there!
Re #1: I should’ve clarified — there’s also a little lock icon (see this other post for a screenshot) that’ll let you mark any other port with a running server as public too (not just the preview port).
Re #2: Great point, I just tried that (unauthenticated fetch from the web preview) and it DOES work. So I do think there’s something else going on in your workspace, that we need to troubleshoot 