fix(19): satisfy CI fast-checks + secret scan

Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
  delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
  dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
  (localSession.test), makeUnauthContext + BrowserContext import (login.spec),
  unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
  eslint-disable directives

Format: prettier --write across the 20 Phase-19 files that were never formatted.

Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.

Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/pwa/src/components/InstructionSheet.test.tsx

@@ -28,7 +28,14 @@ vi.mock('../hooks/usePushSubscription.js', () => ({
 // Mock client so the test doesn't make real network calls.
 vi.mock('../api/client.js', () => ({
   fetchMe: vi.fn().mockResolvedValue({
-    user: { id: 1, displayName: 'Test', color: '#4a90d9', isAdmin: false, needsProviderSetup: false, hasLocalCredential: false },
+    user: {
+      id: 1,
+      displayName: 'Test',
+      color: '#4a90d9',
+      isAdmin: false,
+      needsProviderSetup: false,
+      hasLocalCredential: false,
+    },
   }),
   fetchAuthMode: vi.fn().mockResolvedValue({ localEnabled: true, oidcEnabled: false }),
   fetchChangePassword: vi.fn().mockResolvedValue(undefined),

apps/pwa/src/components/SettingsSheet.tsx

@@ -500,10 +500,7 @@ export function SettingsSheet({ isOpen, onClose }: SettingsSheetProps) {
 
       {/* Surface 13 — Link OIDC confirmation sheet (hasLocalCredential + oidcEnabled gate) */}
       {linkOidcOpen && (
-        <LinkOidcSheet
-          isOpen={linkOidcOpen}
-          onClose={() => setLinkOidcOpen(false)}
-        />
+        <LinkOidcSheet isOpen={linkOidcOpen} onClose={() => setLinkOidcOpen(false)} />
       )}
     </>
   );
@@ -935,7 +932,9 @@ function LinkOidcSheet({ isOpen, onClose }: LinkOidcSheetProps) {
             color: 'var(--color-text-secondary, #6b7280)',
           }}
         >
-          {"After linking, you'll sign in with your OIDC provider instead of a username and password. Your local password will be removed."}
+          {
+            "After linking, you'll sign in with your OIDC provider instead of a username and password. Your local password will be removed."
+          }
         </p>
 
         {/* Secondary note */}