feat(16-01): add boot-time refuse-to-boot guard for dev-bypass in production

- Create apps/api/src/lib/bootGuards.ts with assertNotDevBypassInProduction()
- Guard exits non-zero when NODE_ENV=production AND DEV_AUTH_BYPASS=true (D-08)
- Wire import + call as first statement in isMainModule() block in index.ts
- 3/3 unit tests pass, typecheck green

apps/api/src/index.ts

@@ -15,6 +15,7 @@ import { persistSessionCookie } from './auth/persistSessionCookie.js';
 import { startBrokerPoller } from './broker/poller.js';
 import { startOutboxWorker, initOutboxTrigger } from './broker/outboxWorker.js';
 import { startReminderScheduler } from './broker/reminderScheduler.js';
+import { assertNotDevBypassInProduction } from './lib/bootGuards.js';
 import webpush from 'web-push';
 
 export const app = new Hono();
@@ -110,6 +111,9 @@ function isMainModule(): boolean {
 // (not imported in tests). WR-04: gating the cron schedules here keeps them out of the
 // test process.
 if (isMainModule()) {
+  // D-08: Production safety guard — must be FIRST, before VAPID config, workers, or serve().
+  assertNotDevBypassInProduction();
+
   // Configure VAPID credentials for web-push before starting background workers.
   // VAPID_SUBJECT must be a mailto: or https: URL identifying the operator.
   // The private key is NEVER served to clients; it signs push requests server-side only.