feat(16-01): add boot-time refuse-to-boot guard for dev-bypass in production

- Create apps/api/src/lib/bootGuards.ts with assertNotDevBypassInProduction()
- Guard exits non-zero when NODE_ENV=production AND DEV_AUTH_BYPASS=true (D-08)
- Wire import + call as first statement in isMainModule() block in index.ts
- 3/3 unit tests pass, typecheck green

apps/api/src/lib/bootGuards.ts

@@ -0,0 +1,34 @@
+/**
+ * Boot-time production safety guards (D-08).
+ *
+ * Exported as a standalone function so it can be unit-tested without
+ * forking a process or importing the full app module graph.
+ *
+ * Call assertNotDevBypassInProduction() as the FIRST statement inside
+ * the isMainModule() block in index.ts, before VAPID config, workers,
+ * or serve(). Placement after any network/DB calls would allow a misconfigured
+ * production container to partially start before the guard fires.
+ */
+
+/**
+ * Refuses to start the process when NODE_ENV==='production' AND
+ * DEV_AUTH_BYPASS==='true'.
+ *
+ * Rationale (D-07 + D-08): The production Dockerfile bakes NODE_ENV=production,
+ * engaging the devBypass.ts hard guard. This boot guard is defense-in-depth — it
+ * converts a silent misconfiguration (operator accidentally sets DEV_AUTH_BYPASS=true
+ * in the production compose) into an immediate, loud, non-zero-exit failure instead
+ * of a silently bypassed auth layer.
+ *
+ * The function evaluates env vars at call time (when the app starts), not at import
+ * time, so the test suite can set env vars before calling it without module-cache tricks.
+ */
+export function assertNotDevBypassInProduction(): void {
+  if (process.env.NODE_ENV === 'production' && process.env.DEV_AUTH_BYPASS === 'true') {
+    console.error(
+      '[FATAL] DEV_AUTH_BYPASS=true is set in a production environment. ' +
+        'This configuration is forbidden. Refusing to start.',
+    );
+    process.exit(1);
+  }
+}