feat(19-05): Option C — devSessionCookieMiddleware issues real local-session cookie under bypass

- Add devSessionCookieMiddleware() to devBypass.ts (production hard-guard FIRST)
- Issues local-session JWT cookie for DEV_USER when no cookie present under bypass
- Pure no-op when NODE_ENV=production, DEV_AUTH_BYPASS!=true, or secret not set
- Mount devSessionCookieMiddleware() after devAuthBypass() in index.ts
- Existing devBypass tests: 3/3 pass; typecheck: exit 0

apps/api/src/index.ts

@@ -18,7 +18,7 @@ import {
   processOAuthCallback,
   oidcConfigFallbackMiddleware,
 } from './auth/middleware.js';
-import { devAuthBypass } from './auth/devBypass.js';
+import { devAuthBypass, devSessionCookieMiddleware } from './auth/devBypass.js';
 import { localAuthMiddleware } from './auth/localAuthMiddleware.js';
 import { persistSessionCookie } from './auth/persistSessionCookie.js';
 import { startBrokerPoller } from './broker/poller.js';
@@ -119,6 +119,12 @@ app.route('/api/auth', localAuthRouter);
 // Must be mounted BEFORE oidcAuthMiddleware (T-02-01 mitigation; see auth/devBypass.ts).
 app.use('/api/*', devAuthBypass());
 
+// Phase 19 Option C (AUTH-LOCAL-16, D-14/D-15): issue a real local-session cookie for DEV_USER
+// under bypass so the PWA login gate sees a valid session and skips /login. Pure no-op outside
+// bypass mode (production guard is FIRST check — T-19-24; see auth/devBypass.ts).
+// Mount AFTER devAuthBypass() so DEV_USER is already in context; BEFORE localAuthMiddleware.
+app.use('/api/*', devSessionCookieMiddleware());
+
 // Phase 19 — local-session middleware: sets c.get('user') from 'local-session' JWT cookie.
 // No-op passthrough when no cookie is present — the OIDC guard fires for unauthenticated.
 // Runs AFTER devAuthBypass (which may set c.get('user') first) and BEFORE the OIDC guard.