fix(19): satisfy CI fast-checks + secret scan

Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
  delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
  dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
  (localSession.test), makeUnauthContext + BrowserContext import (login.spec),
  unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
  eslint-disable directives

Format: prettier --write across the 20 Phase-19 files that were never formatted.

Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.

Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/pwa/src/App.tsx

@@ -195,10 +195,7 @@ export default function App() {
             Phase 19: shown when the user is unauthenticated AND localEnabled === true.
             The route itself always renders LoginPage (authMode gating is in the `*` route gate below).
             LoginPage receives authMode so it can show the optional OIDC button when oidcEnabled. */}
-        <Route
-          path="/login"
-          element={<LoginPage authMode={authModeQuery.data} />}
-        />
+        <Route path="/login" element={<LoginPage authMode={authModeQuery.data} />} />
 
         {/* All other routes are gated on setup completion */}
         <Route
@@ -213,7 +210,10 @@ export default function App() {
             ) : meQuery.isError && !meQuery.isLoading && authModeQuery.data?.localEnabled ? (
               // Unauthenticated + localEnabled: redirect to /login
               <Navigate to="/login" replace />
-            ) : meQuery.isError && !meQuery.isLoading && !authModeQuery.data?.localEnabled && authModeQuery.data?.oidcEnabled ? (
+            ) : meQuery.isError &&
+              !meQuery.isLoading &&
+              !authModeQuery.data?.localEnabled &&
+              authModeQuery.data?.oidcEnabled ? (
               // Unauthenticated + OIDC-only mode: top-level redirect to /api/login (today's behavior)
               // Use a render side-effect via useEffect isn't available here; use a helper element
               <OidcRedirect />