fix(02): dev-auth bypass no longer blocked by oidcAuthMiddleware

- index.ts: compute devBypassActive at startup; skip app.use(oidcAuthMiddleware)
  entirely when active so the OIDC guard never runs in local dev
- routes/me.ts: read c.get('user') first; return dev identity directly when
  devAuthBypass injected it, bypassing getAuth() and the DB upsert
- auth/devBypass.ts: add ContextVariableMap augmentation for 'user' key;
  correct stale comment that claimed getAuth/401 path was still active

apps/api/src/routes/me.ts

@@ -1,13 +1,19 @@
 /**
  * GET /api/me — returns the authenticated user's identity and assigned color.
  *
- * Flow:
+ * Flow (normal — OIDC active):
  *   1. getAuth(c) reads iss + sub from the OIDC session JWT cookie
  *      (validated and refreshed by oidcAuthMiddleware — never reaches here unauthenticated)
  *   2. upsertUser(iss, sub, email) writes the user row on first visit, returns
  *      the existing row on subsequent visits (idempotent, keyed on iss+sub, D-10)
  *   3. Returns { user: { id, displayName, color } }
  *
+ * Flow (dev bypass — DEV_AUTH_BYPASS=true, non-production):
+ *   devAuthBypass() injects DEV_USER via c.set('user', DEV_USER). oidcAuthMiddleware
+ *   is NOT mounted in index.ts when the bypass is active, so getAuth(c) is never called.
+ *   This handler reads c.get('user') first and short-circuits to return the dev identity
+ *   directly, skipping the DB upsert.
+ *
  * The OIDC session cookie is httpOnly + Secure + SameSite (T-02-03).
  * No credential or refresh-token data is included in the response (T-02-04).
  */
@@ -15,12 +21,28 @@
 import { Hono } from 'hono'
 import { getAuth } from '../auth/middleware.js'
 import { upsertUser } from '../auth/user.js'
+// Side-effect import: brings in the ContextVariableMap augmentation for c.get('user')
+import '../auth/devBypass.js'
 
 export const meRouter = new Hono()
 
 meRouter.get('/', async (c) => {
-  // getAuth returns null only if the session is invalid — oidcAuthMiddleware on
-  // /api/* redirects unauthenticated requests before this handler is reached.
+  // Dev-auth bypass path: devAuthBypass() sets c.get('user') to DEV_USER when active.
+  // Return the injected dev identity directly — no DB round-trip, no OIDC session needed.
+  const devUser = c.get('user')
+  if (devUser) {
+    return c.json({
+      user: {
+        id: devUser.id,
+        displayName: devUser.displayName,
+        color: devUser.color,
+      },
+    })
+  }
+
+  // Normal OIDC path: getAuth returns null only if the session is invalid.
+  // oidcAuthMiddleware on /api/* redirects unauthenticated requests before this handler
+  // is reached, so null here indicates a genuine session error.
   const auth = await getAuth(c)
   if (!auth) {
     return c.json({ error: 'Unauthorized' }, 401)