feat(01-02): wire OIDC middleware, /api/me route, and authenticated PWA shell

- src/auth/middleware.ts: re-exports oidcAuthMiddleware, processOAuthCallback,
  getAuth from @hono/oidc-auth; documents required env vars and AUTH-02
  refresh-token rotation (no iframe, D-12)
- src/routes/me.ts: GET / calls getAuth → upsertUser(iss, sub, email) →
  returns { user: { id, displayName, color } }; identity keyed on iss+sub
- src/index.ts: /callback registered before oidcAuthMiddleware; /api/*
  guarded; /health remains unauthenticated; /api/me mounted
- apps/pwa/src/api/client.ts: typed fetchMe() with credentials: 'include'
- apps/pwa/src/App.tsx: useQuery(['me'], fetchMe); renders member name and
  color swatch; retains /health stack indicator from Plan 01
- tsc --noEmit: clean; all tests pass

apps/api/src/index.ts

@@ -2,14 +2,28 @@ import { serve } from '@hono/node-server'
 import { serveStatic } from '@hono/node-server/serve-static'
 import { Hono } from 'hono'
 import { healthRouter } from './routes/health.js'
+import { meRouter } from './routes/me.js'
+import { oidcAuthMiddleware, processOAuthCallback } from './auth/middleware.js'
 
 export const app = new Hono()
 
-// GET /health — unauthenticated, before any auth middleware (T-01-03)
+// GET /health — unauthenticated, mounted BEFORE the OIDC guard (T-01-03, T-02-05)
 app.route('/health', healthRouter)
 
+// OIDC callback — must be registered BEFORE oidcAuthMiddleware so the
+// authorization-code exchange is not itself intercepted by the auth check (T-02-02)
+app.get('/callback', (c) => processOAuthCallback(c))
+
+// Protect all /api/* routes with OIDC session middleware (AUTH-01, T-02-05).
+// Unauthenticated requests receive a 302 redirect to Authelia's authorize endpoint.
+// OIDC_AUTH_EXTERNAL_URL is MANDATORY behind Pangolin to construct the correct
+// redirect_uri (Pitfall 1). Set it to https://familysync.<domain>.
+app.use('/api/*', oidcAuthMiddleware())
+
+// Protected API routes
+app.route('/api/me', meRouter)
+
 // Serve React PWA static assets from ./public (Vite build output)
-// In Phase 2, OIDC callback + protected /api routes will be mounted here
 app.use('/assets/*', serveStatic({ root: './public' }))
 app.get('*', serveStatic({ path: './public/index.html' }))