fix(02): dev-auth bypass no longer blocked by oidcAuthMiddleware

- index.ts: compute devBypassActive at startup; skip app.use(oidcAuthMiddleware)
  entirely when active so the OIDC guard never runs in local dev
- routes/me.ts: read c.get('user') first; return dev identity directly when
  devAuthBypass injected it, bypassing getAuth() and the DB upsert
- auth/devBypass.ts: add ContextVariableMap augmentation for 'user' key;
  correct stale comment that claimed getAuth/401 path was still active

apps/api/src/auth/devBypass.ts

@@ -9,12 +9,12 @@
  * When the bypass is inactive (wrong env, or NODE_ENV=production) the middleware is a
  * pure no-op passthrough — production behaviour is unchanged.
  *
- * Context key: 'user' — matches the key read by downstream consumers (e.g. routes/me.ts
- * calls getAuth(c) from @hono/oidc-auth; the events route will read c.get('user') directly).
- * In dev bypass mode, c.get('user') returns DEV_USER. getAuth(c) is still called by me.ts
- * but will return null because no OIDC session cookie is present; me.ts guards this with
- * `if (!auth) return 401`. When using the bypass, consume c.get('user') directly in routes
- * that need the user object (events route pattern in Plan 02).
+ * Context key: 'user' — matches the key read by downstream consumers.
+ * In dev bypass mode, c.get('user') returns DEV_USER. index.ts does NOT mount
+ * oidcAuthMiddleware when devBypassActive is true, so getAuth(c) is never called.
+ * routes/me.ts reads c.get('user') first and returns the dev identity directly,
+ * skipping the DB upsert and getAuth path entirely. Other routes (e.g. events)
+ * also read c.get('user') directly — same pattern, no change needed there.
  *
  * Security:
  *   - The FIRST conditional is always `NODE_ENV === 'production'` — checked before reading
@@ -35,6 +35,18 @@ export const DEV_USER = {
   color: COLOR_PALETTE[0], // '#4A90D9' — first palette slot
 } as const
 
+/**
+ * Extend Hono's ContextVariableMap so that c.get('user') / c.set('user', ...)
+ * are statically typed throughout the app. The value type is the DEV_USER shape,
+ * which is compatible with both the bypass path and any future app-level user object
+ * stored on context (they share the same id/displayName/color subset).
+ */
+declare module 'hono' {
+  interface ContextVariableMap {
+    user: typeof DEV_USER
+  }
+}
+
 /**
  * Returns a Hono MiddlewareHandler that injects DEV_USER into the request context
  * when the dev-auth bypass is active, or a pure passthrough when inactive.