feat(12-02): OIDC boot env-OR-app_config fallback + pre-auth mount verification

- A2 CONFIRMED: @hono/oidc-auth reads OIDC_ISSUER/OIDC_CLIENT_ID/OIDC_AUTH_EXTERNAL_URL
  at per-request call time (env(c) → process.env), NOT at import time — fresh instance
  boots cleanly without OIDC env vars
- Implement oidcConfigFallbackMiddleware in auth/middleware.ts: reads OIDC_ISSUER,
  OIDC_CLIENT_ID, OIDC_AUTH_EXTERNAL_URL from app_config when process.env is absent,
  injects into process.env before oidcAuthMiddleware() reads it (D-02/D-03/Recommendation a)
- Mount oidcConfigFallbackMiddleware before oidcAuthMiddleware() in index.ts so
  wizard-configured instances work before a container restart
- Verify /api/setup mount order: line 49 < devAuthBypass line 54 (T-12-09/Pitfall 1)
- Fix push.test.ts vi.doMock for middleware.js: add oidcConfigFallbackMiddleware stub
- 394 tests pass | 5 todo (D-08 RED scaffolds); typecheck clean

apps/api/tests/routes/push.test.ts

@@ -117,6 +117,7 @@ describe('POST /api/push/subscription', () => {
       oidcAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
       processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) =>
         c.json({ ok: true }),
+      oidcConfigFallbackMiddleware: async (_c: unknown, next: () => Promise<void>) => next(),
     }));
 
     const { app: freshApp } = await import('../../src/index.js?v=unauth');