fix(19): satisfy CI fast-checks + secret scan

Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
  delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
  dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
  (localSession.test), makeUnauthContext + BrowserContext import (login.spec),
  unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
  eslint-disable directives

Format: prettier --write across the 20 Phase-19 files that were never formatted.

Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.

Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/tests/routes/admin.test.ts

@@ -30,7 +30,13 @@ import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { randomUUID } from 'node:crypto';
 import { eq } from 'drizzle-orm';
 import { db } from '../../src/db/client.js';
-import { users, memberCredentials, calendars, appConfig, localCredentials } from '../../src/db/schema.js';
+import {
+  users,
+  memberCredentials,
+  calendars,
+  appConfig,
+  localCredentials,
+} from '../../src/db/schema.js';
 import { verifyPassword } from '../../src/auth/localCredentials.js';
 
 // ---------------------------------------------------------------------------
@@ -949,7 +955,8 @@ describe('POST /api/admin/members', () => {
 
   it('Test 3: admin can reset any member password without knowing the current one', async () => {
     const adminId = await seedUser('admin-reset-pw', true);
-    const memberId = await seedUser('member-reset-target', false);
+    // Seeded for DB-state parity; this test creates its own member via the admin API below.
+    await seedUser('member-reset-target', false);
     currentDevUserId = adminId;
     const app = await getApp();
 
@@ -1025,7 +1032,9 @@ describe('POST /api/admin/members', () => {
     // GET /members should show hasLocalCredential:true for this member
     const getRes = await app.fetch(jsonRequest('GET', '/api/admin/members'));
     expect(getRes.status).toBe(200);
-    const body = (await getRes.json()) as { members: Array<{ id: number; hasLocalCredential: boolean }> };
+    const body = (await getRes.json()) as {
+      members: Array<{ id: number; hasLocalCredential: boolean }>;
+    };
 
     const memberRow = body.members.find((m) => m.id === newMemberId);
     expect(memberRow).toBeDefined();