feat(19-01): implement localSession JWT cookie helpers and assertLocalSessionSecretSet boot guard

- localSession.ts: issueLocalSessionCookie/verifyLocalSessionCookie/clearLocalSessionCookie
  - Jwt namespace import from hono/utils/jwt (Pitfall 8 — not named sign/verify)
  - Cookie name: 'local-session' (distinct from 'oidc-auth', Pitfall 4)
  - httpOnly, sameSite=Lax, secure in production; try/catch on Jwt.verify (Pitfall 9)
  - verifyLocalSessionCookie returns null (never throws) on any error
- bootGuards.ts: assertLocalSessionSecretSet — exit(1) if secret missing/<32 chars
  - Exempt when DEV_AUTH_BYPASS=true (bypass doesn't issue local-session cookies)
- index.ts: wire assertLocalSessionSecretSet() after assertNotDevBypassInProduction()
- All 5 unit tests pass; typecheck exits 0

apps/api/src/index.ts

@@ -21,7 +21,7 @@ import { persistSessionCookie } from './auth/persistSessionCookie.js';
 import { startBrokerPoller } from './broker/poller.js';
 import { startOutboxWorker, initOutboxTrigger } from './broker/outboxWorker.js';
 import { startReminderScheduler } from './broker/reminderScheduler.js';
-import { assertNotDevBypassInProduction } from './lib/bootGuards.js';
+import { assertNotDevBypassInProduction, assertLocalSessionSecretSet } from './lib/bootGuards.js';
 import webpush from 'web-push';
 
 export const app = new Hono();
@@ -134,6 +134,8 @@ function isMainModule(): boolean {
 if (isMainModule()) {
   // D-08: Production safety guard — must be FIRST, before VAPID config, workers, or serve().
   assertNotDevBypassInProduction();
+  // D-05 / T-19-03: Refuse to start if LOCAL_SESSION_SECRET is missing/short in non-bypass mode.
+  assertLocalSessionSecretSet();
 
   // Configure VAPID credentials for web-push before starting background workers.
   // VAPID_SUBJECT must be a mailto: or https: URL identifying the operator.