fix(19): BL-04 keep context oidcIss/oidcSub null for local users (no fabricated identity sentinels)

apps/api/src/auth/devBypass.ts

@@ -44,15 +44,32 @@ export const DEV_USER = {
   color: COLOR_PALETTE[0], // '#4A90D9' — first palette slot
 } as const;
 
+/**
+ * The shape stored on c.get('user') across the bypass, local-session, and OIDC paths.
+ *
+ * BL-04: oidcIss/oidcSub are NULLABLE. Local users have null OIDC fields, and
+ * localAuthMiddleware must NOT fabricate sentinel ('local'/String(id)) values — those
+ * share the uniqueness domain (uniq_oidc_identity) with real OIDC identities and could
+ * collide with a genuine (iss,sub) pair if ever persisted. DEV_USER carries non-null
+ * 'dev'/'dev-user' values and remains assignable to this widened shape.
+ */
+export interface ContextUser {
+  id: number;
+  oidcIss: string | null;
+  oidcSub: string | null;
+  displayName: string | null;
+  color: string;
+}
+
 /**
  * Extend Hono's ContextVariableMap so that c.get('user') / c.set('user', ...)
- * are statically typed throughout the app. The value type is the DEV_USER shape,
- * which is compatible with both the bypass path and any future app-level user object
- * stored on context (they share the same id/displayName/color subset).
+ * are statically typed throughout the app. The value type is ContextUser — the shape
+ * shared by the dev-bypass path, the local-session path (nullable oidc fields), and any
+ * future app-level user object stored on context.
  */
 declare module 'hono' {
   interface ContextVariableMap {
-    user: typeof DEV_USER;
+    user: ContextUser;
   }
 }