I'm the one who deployed to the demo instance to test if the image/manifest could be pulled from an instance without credentials.
And yes, the HTTP endpoint returns a 404 because it's a REST API.
You can fetch the server status even without a token :
curl https://terraria.demo.cloudron.io/v2/server/status
{
"status": "200",
"name": "",
"serverversion": "v1.4.5.6",
"tshockversion": "6.1.0.0",
"port": 7777,
"playercount": 0,
"maxplayers": 16,
"world": "World",
"uptime": "0.02:02:19",
"serverpassword": false
}