- Asserts GET /api/me returns 200 with DEV_USER (id=1, color=#4A90D9) when DEV_AUTH_BYPASS=true and NODE_ENV!=production - Asserts oidcAuthMiddleware is NOT wired when bypass is active - Asserts oidcAuthMiddleware IS wired when bypass is absent - Asserts 401 from getAuth(null) fallback path with no OIDC session