feat(02-01): dev-auth bypass middleware with production hard guard

- Create apps/api/src/auth/devBypass.ts: devAuthBypass() middleware with
  NODE_ENV=production hard guard as first conditional (T-02-01 mitigation)
- Exports DEV_USER const (id:1, color:COLOR_PALETTE[0]) for test reference
- Mount devAuthBypass() before oidcAuthMiddleware on /api/* in index.ts
- Add devBypass.test.ts: all three behavioral cases pass (production guard,
  unset-flag passthrough, active-injection)
- Add DEV_AUTH_BYPASS to .env.example with production warning comment
- Extend docs/deployment.md with dev-auth bypass section and production prohibition

.env.example

@@ -17,3 +17,6 @@ OIDC_AUTH_EXTERNAL_URL=https://familysync.yourdomain.com
 # CalDAV broker encryption key — generate with:
 # node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 APP_PASSWORD_ENCRYPTION_KEY=
+
+# DEV ONLY — injects a fixed dev user, skips Authelia. Hard-disabled when NODE_ENV=production. NEVER set in prod.
+# DEV_AUTH_BYPASS=true