feat(02-01): dev-auth bypass middleware with production hard guard

- Create apps/api/src/auth/devBypass.ts: devAuthBypass() middleware with
  NODE_ENV=production hard guard as first conditional (T-02-01 mitigation)
- Exports DEV_USER const (id:1, color:COLOR_PALETTE[0]) for test reference
- Mount devAuthBypass() before oidcAuthMiddleware on /api/* in index.ts
- Add devBypass.test.ts: all three behavioral cases pass (production guard,
  unset-flag passthrough, active-injection)
- Add DEV_AUTH_BYPASS to .env.example with production warning comment
- Extend docs/deployment.md with dev-auth bypass section and production prohibition

docs/deployment.md

@@ -235,3 +235,41 @@ curl -N -H "Cookie: oidc-auth=<value>" https://familysync.DOMAIN/api/sse/heartbe
   as a Phase 4 constraint and plan a reconnect/fallback strategy.
 
 Record results in `.planning/phases/01-foundation-broker-spike/01-HUMAN-UAT.md`.
+
+---
+
+## Dev-auth bypass (Phase 2+ local development)
+
+FamilySync builds Phase 2 and Phase 3 features behind a dev-auth bypass so live Authelia is not
+required during development (D-14). The bypass injects a fixed dev user into the request context
+and short-circuits the OIDC guard.
+
+**Activation (local dev only):**
+
+```bash
+# In your local .env:
+DEV_AUTH_BYPASS=true
+NODE_ENV=development   # or test, or any value other than 'production'
+```
+
+**Hard production guard:**
+
+The bypass middleware's FIRST conditional is `process.env.NODE_ENV === 'production'`. If this is
+true, the middleware returns a no-op passthrough regardless of any other env var. This means:
+
+- Even if `DEV_AUTH_BYPASS=true` is accidentally present in a production container, it has zero
+  effect. The OIDC guard fires normally.
+- The hard guard is checked before `DEV_AUTH_BYPASS` is read — there is no code path where
+  production + bypass = unauthenticated access.
+
+**Production Docker Compose prohibition:**
+
+The production `docker-compose.yml` MUST NOT include `DEV_AUTH_BYPASS` in the environment block.
+The `.env.example` entry for `DEV_AUTH_BYPASS` is commented out by default as a reminder.
+
+**What the bypass does:**
+
+Sets `c.set('user', DEV_USER)` in the Hono context before `oidcAuthMiddleware` runs. Routes that
+read `c.get('user')` receive a fixed dev user `{ id: 1, displayName: 'Dev User', color: '#4A90D9' }`.
+Routes that call `getAuth(c)` from `@hono/oidc-auth` will still return null (no OIDC cookie is
+present) — those routes must be updated to prefer `c.get('user')` when building Phase 2+.