fix(19): satisfy CI fast-checks + secret scan

Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
  delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
  dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
  (localSession.test), makeUnauthContext + BrowserContext import (login.spec),
  unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
  eslint-disable directives

Format: prettier --write across the 20 Phase-19 files that were never formatted.

Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.

Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/routes/localAuth.ts

@@ -186,7 +186,10 @@ localAuthRouter.post('/local/login', zValidator('json', loginSchema, noEchoHook)
       .limit(1);
     cred = found;
   } catch (err) {
-    console.error('[localAuth/POST /local/login] DB error:', err instanceof Error ? err.message : String(err));
+    console.error(
+      '[localAuth/POST /local/login] DB error:',
+      err instanceof Error ? err.message : String(err),
+    );
     return c.json({ error: 'Service unavailable' }, 503);
   }
 
@@ -200,7 +203,12 @@ localAuthRouter.post('/local/login', zValidator('json', loginSchema, noEchoHook)
 
   if (!valid || !cred) {
     // Increment failure counter (keyed on username)
-    const cur = loginAttempts.get(key) ?? { count: 0, lockedUntil: 0, lockedOut: false, lockedAt: 0 };
+    const cur = loginAttempts.get(key) ?? {
+      count: 0,
+      lockedUntil: 0,
+      lockedOut: false,
+      lockedAt: 0,
+    };
     cur.count += 1;
     cur.lockedUntil = Date.now() + RATE_WINDOW_SECS * 1000;
     cur.lockedOut = cur.count >= LOCKOUT_FAILURES;
@@ -215,7 +223,10 @@ localAuthRouter.post('/local/login', zValidator('json', loginSchema, noEchoHook)
   try {
     await issueLocalSessionCookie(c, cred.userId);
   } catch (err) {
-    console.error('[localAuth/POST /local/login] Cookie issue error:', err instanceof Error ? err.message : String(err));
+    console.error(
+      '[localAuth/POST /local/login] Cookie issue error:',
+      err instanceof Error ? err.message : String(err),
+    );
     return c.json({ error: 'Service unavailable' }, 503);
   }
   return c.json({ ok: true }, 200);
@@ -226,7 +237,7 @@ localAuthRouter.post('/local/login', zValidator('json', loginSchema, noEchoHook)
 // GET  /local/logout  →  GET  /api/auth/local/logout (browser-redirect alias)
 // ---------------------------------------------------------------------------
 
-async function handleLogout(c: Context) {
+function handleLogout(c: Context) {
   clearLocalSessionCookie(c);
   return c.json({ ok: true }, 200);
 }