style(13-03): apply Prettier formatting across repo

Mechanical reformat — no logic changes. 398 files changed, 19125
insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc
(singleQuote:true, semi:true, tabWidth:2, trailingComma:all,
printWidth:100). Isolated per D-13-08 for reviewability.

apps/api/src/routes/me.ts

@@ -19,18 +19,18 @@
  * No credential or refresh-token data is included in the response (T-02-04).
  */
 
-import { Hono } from 'hono'
-import { getAuth } from '../auth/middleware.js'
-import { upsertUser, deriveDisplayName } from '../auth/user.js'
+import { Hono } from 'hono';
+import { getAuth } from '../auth/middleware.js';
+import { upsertUser, deriveDisplayName } from '../auth/user.js';
 // Side-effect import: brings in the ContextVariableMap augmentation for c.get('user')
-import '../auth/devBypass.js'
+import '../auth/devBypass.js';
 
-export const meRouter = new Hono()
+export const meRouter = new Hono();
 
 meRouter.get('/', async (c) => {
   // Dev-auth bypass path: devAuthBypass() sets c.get('user') to DEV_USER when active.
   // Return the injected dev identity directly — no DB round-trip, no OIDC session needed.
-  const devUser = c.get('user')
+  const devUser = c.get('user');
   if (devUser) {
     return c.json({
       user: {
@@ -38,30 +38,30 @@ meRouter.get('/', async (c) => {
         displayName: devUser.displayName,
         color: devUser.color,
       },
-    })
+    });
   }
 
   // Normal OIDC path: getAuth returns null only if the session is invalid.
   // oidcAuthMiddleware on /api/* redirects unauthenticated requests before this handler
   // is reached, so null here indicates a genuine session error.
-  const auth = await getAuth(c)
+  const auth = await getAuth(c);
   if (!auth) {
-    return c.json({ error: 'Unauthorized' }, 401)
+    return c.json({ error: 'Unauthorized' }, 401);
   }
 
   // iss and sub are the stable identity fields — identity is always keyed on iss+sub (D-10).
-  const iss = (auth.iss as string | undefined) ?? ''
-  const sub = auth.sub ?? ''
+  const iss = (auth.iss as string | undefined) ?? '';
+  const sub = auth.sub ?? '';
 
   // Derive the best available display name from OIDC claims (name →
   // preferred_username → email → sub fallback). Shared helper keeps every
   // upsert call site in agreement (see deriveDisplayName).
-  const displayName = deriveDisplayName(auth)
+  const displayName = deriveDisplayName(auth);
 
-  const user = await upsertUser(iss, sub, displayName)
+  const user = await upsertUser(iss, sub, displayName);
 
   if (!user) {
-    return c.json({ error: 'Could not resolve user' }, 500)
+    return c.json({ error: 'Could not resolve user' }, 500);
   }
 
   return c.json({
@@ -70,5 +70,5 @@ meRouter.get('/', async (c) => {
       displayName: user.displayName,
       color: user.color,
     },
-  })
-})
+  });
+});