feat(19-03): wire /callback link branch, OIDC-guard skip, de-Authelia comments

- /callback: reads signed state, extracts linkUserId, calls linkOidcToUser after OIDC session set; OidcLinkConflictError redirects to /?error=oidc-link-conflict
- OIDC guard: oidcAuthMiddleware() factory called once at construction, handler invoked per-request inside skip-when-user-set wrapper (D-03)
- middleware.ts: de-Authelia-ize comments — generic OIDC identity provider language (D-06, AUTH-LOCAL-18)
- localAuthMiddleware.ts: cast to typeof DEV_USER for ContextVariableMap type compatibility
- All 446 tests pass; typecheck clean

apps/api/src/auth/middleware.ts

@@ -1,12 +1,12 @@
 /**
  * OIDC authentication middleware wiring.
  *
- * Configures @hono/oidc-auth for Authelia as the identity provider.
+ * Configures @hono/oidc-auth for the generic OIDC identity provider (D-06).
  *
  * Required env vars:
  *   OIDC_AUTH_SECRET          — 32+ char random string for JWT cookie signing (T-02-03)
- *   OIDC_ISSUER               — Authelia base URL (middleware fetches /.well-known/openid-configuration)
- *   OIDC_CLIENT_ID            — registered client ID in Authelia
+ *   OIDC_ISSUER               — OIDC issuer URL (middleware fetches /.well-known/openid-configuration)
+ *   OIDC_CLIENT_ID            — registered client ID at the OIDC provider
  *   OIDC_CLIENT_SECRET        — PLAIN text secret (NOT the pbkdf2 hash — see Pitfall 7)
  *   OIDC_REDIRECT_URI         — https://familysync.<domain>/callback
  *   OIDC_AUTH_EXTERNAL_URL    — https://familysync.<domain> — MANDATORY behind Pangolin (Pitfall 1)
@@ -30,7 +30,7 @@
  *   Every OIDC_AUTH_REFRESH_INTERVAL (default 15 min) the middleware calls
  *   the token endpoint with the stored refresh token — no iframe required (D-12).
  *   Session lifespan is governed by OIDC_AUTH_EXPIRES (default 1 day) and
- *   Authelia's refresh_token_lifespan.
+ *   the OIDC provider's refresh_token_lifespan.
  *
  * Scopes: openid, profile, email only — no 'groups' scope (D-11).
  *