fix(02): dev-auth bypass no longer blocked by oidcAuthMiddleware

- index.ts: compute devBypassActive at startup; skip app.use(oidcAuthMiddleware)
  entirely when active so the OIDC guard never runs in local dev
- routes/me.ts: read c.get('user') first; return dev identity directly when
  devAuthBypass injected it, bypassing getAuth() and the DB upsert
- auth/devBypass.ts: add ContextVariableMap augmentation for 'user' key;
  correct stale comment that claimed getAuth/401 path was still active

apps/api/src/index.ts

@@ -11,6 +11,17 @@ import { startBrokerPoller } from './broker/poller.js'
 
 export const app = new Hono()
 
+// Compute once at startup: bypass is active only in non-production with explicit opt-in.
+// In production NODE_ENV='production' → devBypassActive=false → OIDC is always mounted.
+const devBypassActive =
+  process.env.NODE_ENV !== 'production' && process.env.DEV_AUTH_BYPASS === 'true'
+
+if (devBypassActive) {
+  console.warn(
+    '⚠ DEV_AUTH_BYPASS active — OIDC guard DISABLED. Never use in production.',
+  )
+}
+
 // OIDC callback — must be registered BEFORE oidcAuthMiddleware so the
 // authorization-code exchange is not itself intercepted by the auth check (T-02-02)
 app.get('/callback', (c) => processOAuthCallback(c))
@@ -19,15 +30,19 @@ app.get('/callback', (c) => processOAuthCallback(c))
 app.route('/health', healthRouter)
 
 // Dev-auth bypass — no-op passthrough unless DEV_AUTH_BYPASS=true AND NODE_ENV!='production'.
-// When active, injects a fixed dev user so the OIDC guard below is not required for local dev.
+// When active, injects DEV_USER into the Hono context and the OIDC guard is NOT mounted.
 // Must be mounted BEFORE oidcAuthMiddleware (T-02-01 mitigation; see auth/devBypass.ts).
 app.use('/api/*', devAuthBypass())
 
 // Protect all /api/* routes with OIDC session middleware (AUTH-01, T-02-05).
+// Skipped entirely when devBypassActive so that local dev works without Authelia.
+// In production devBypassActive is always false — OIDC is unconditionally mounted.
 // Unauthenticated requests receive a 302 redirect to Authelia's authorize endpoint.
 // OIDC_AUTH_EXTERNAL_URL is MANDATORY behind Pangolin to construct the correct
 // redirect_uri (Pitfall 1). Set it to https://familysync.<domain>.
-app.use('/api/*', oidcAuthMiddleware())
+if (!devBypassActive) {
+  app.use('/api/*', oidcAuthMiddleware())
+}
 
 // Protected API routes (behind oidcAuthMiddleware)
 app.route('/api/me', meRouter)