fix(19): satisfy CI fast-checks + secret scan

Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
  delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
  dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
  (localSession.test), makeUnauthContext + BrowserContext import (login.spec),
  unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
  eslint-disable directives

Format: prettier --write across the 20 Phase-19 files that were never formatted.

Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.

Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/tests/auth/localAuthMiddleware.test.ts

@@ -73,7 +73,6 @@ function makeApp(middleware: ReturnType<typeof vi.fn>, presetUser?: unknown) {
     });
   }
 
-  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
   app.use('/api/*', middleware());
 
   let capturedUser: unknown = 'NOT_SET_SENTINEL';
@@ -147,7 +146,13 @@ describe('localAuthMiddleware', () => {
     const res = await app.request('/api/test');
     expect(res.status).toBe(200);
     expect(capturedUser).toBeDefined();
-    const u = capturedUser as { id: number; oidcIss: string; oidcSub: string; displayName: string | null; color: string };
+    const u = capturedUser as {
+      id: number;
+      oidcIss: string;
+      oidcSub: string;
+      displayName: string | null;
+      color: string;
+    };
     expect(u.id).toBe(7);
     expect(u.oidcIss).toBe('https://auth.example.com');
     expect(u.oidcSub).toBe('sub-abc');

apps/api/tests/auth/localSession.test.ts

@@ -18,33 +18,6 @@ import { Hono } from 'hono';
 const TEST_SECRET = 'test-secret-that-is-at-least-32-characters-long-for-jwt';
 const TEST_USER_ID = 42;
 
-// ── Helpers ────────────────────────────────────────────────────────────────────
-
-/** Create a minimal Hono test app with an issue route and a verify route. */
-function makeTestApp(secret: string | undefined) {
-  return {
-    setup: async () => {
-      // Import inside function to pick up modified env
-      const { issueLocalSessionCookie, verifyLocalSessionCookie } = await import(
-        '../../src/auth/localSession.js'
-      );
-      const app = new Hono();
-
-      app.post('/issue', async (c) => {
-        await issueLocalSessionCookie(c, TEST_USER_ID);
-        return c.json({ ok: true });
-      });
-
-      app.get('/verify', async (c) => {
-        const userId = await verifyLocalSessionCookie(c);
-        return c.json({ userId });
-      });
-
-      return app;
-    },
-  };
-}
-
 describe('issueLocalSessionCookie / verifyLocalSessionCookie', () => {
   let originalEnv: NodeJS.ProcessEnv;
 
@@ -60,9 +33,8 @@ describe('issueLocalSessionCookie / verifyLocalSessionCookie', () => {
   });
 
   it('Test 1: issue then verify round-trips userId', async () => {
-    const { issueLocalSessionCookie, verifyLocalSessionCookie } = await import(
-      '../../src/auth/localSession.js'
-    );
+    const { issueLocalSessionCookie, verifyLocalSessionCookie } =
+      await import('../../src/auth/localSession.js');
     const app = new Hono();
 
     app.post('/issue', async (c) => {