feat(01-02): wire OIDC middleware, /api/me route, and authenticated PWA shell

- src/auth/middleware.ts: re-exports oidcAuthMiddleware, processOAuthCallback,
  getAuth from @hono/oidc-auth; documents required env vars and AUTH-02
  refresh-token rotation (no iframe, D-12)
- src/routes/me.ts: GET / calls getAuth → upsertUser(iss, sub, email) →
  returns { user: { id, displayName, color } }; identity keyed on iss+sub
- src/index.ts: /callback registered before oidcAuthMiddleware; /api/*
  guarded; /health remains unauthenticated; /api/me mounted
- apps/pwa/src/api/client.ts: typed fetchMe() with credentials: 'include'
- apps/pwa/src/App.tsx: useQuery(['me'], fetchMe); renders member name and
  color swatch; retains /health stack indicator from Plan 01
- tsc --noEmit: clean; all tests pass

apps/api/src/auth/middleware.ts

@@ -0,0 +1,26 @@
+/**
+ * OIDC authentication middleware wiring.
+ *
+ * Configures @hono/oidc-auth for Authelia as the identity provider.
+ *
+ * Required env vars:
+ *   OIDC_AUTH_SECRET          — 32+ char random string for JWT cookie signing (T-02-03)
+ *   OIDC_ISSUER               — Authelia base URL (middleware fetches /.well-known/openid-configuration)
+ *   OIDC_CLIENT_ID            — registered client ID in Authelia
+ *   OIDC_CLIENT_SECRET        — PLAIN text secret (NOT the pbkdf2 hash — see Pitfall 7)
+ *   OIDC_REDIRECT_URI         — https://familysync.<domain>/callback
+ *   OIDC_AUTH_EXTERNAL_URL    — https://familysync.<domain> — MANDATORY behind Pangolin (Pitfall 1)
+ *
+ * Session persistence (AUTH-02):
+ *   @hono/oidc-auth stores the refresh token in the signed JWT cookie.
+ *   Every OIDC_AUTH_REFRESH_INTERVAL (default 15 min) the middleware calls
+ *   the token endpoint with the stored refresh token — no iframe required (D-12).
+ *   Session lifespan is governed by OIDC_AUTH_EXPIRES (default 1 day) and
+ *   Authelia's refresh_token_lifespan.
+ *
+ * Scopes: openid, profile, email only — no 'groups' scope (D-11).
+ *
+ * Source: https://github.com/honojs/middleware/tree/main/packages/oidc-auth
+ */
+
+export { oidcAuthMiddleware, processOAuthCallback, getAuth } from '@hono/oidc-auth'