fix: OIDC auth flow, Vite proxy, and PostgreSQL query compat

- Add auth redirect in root layout for unauthenticated users
- Proxy OIDC routes (/login, /callback, /logout) through Vite dev server
- Strip Secure flag from OIDC cookies in dev mode (HTTP localhost)
- Disable retry on auth query to prevent stale cookie loops
- Fix SQLite .get()/.all()/.run() calls in category and global-item
  services for PostgreSQL compatibility
- Add userId scoping to category service functions
- Add OIDC error logging in auth middleware
- Apply linter auto-formatting across affected files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/client/routes/__root.tsx

@@ -2,6 +2,7 @@ import {
 	createRootRoute,
 	type ErrorComponentProps,
 	Outlet,
+	useLocation,
 	useMatchRoute,
 	useNavigate,
 	useRouter,
@@ -72,7 +73,8 @@ function RootErrorBoundary({ error, reset }: ErrorComponentProps) {
 
 function RootLayout() {
 	const navigate = useNavigate();
-	const { data: auth } = useAuth();
+	const location = useLocation();
+	const { data: auth, isLoading: authLoading } = useAuth();
 	const isAuthenticated = !!auth?.user;
 
 	// Item panel state
@@ -99,7 +101,7 @@ function RootLayout() {
 	const resolveCandidateId = useUIStore((s) => s.resolveCandidateId);
 	const closeResolveDialog = useUIStore((s) => s.closeResolveDialog);
 
-	// Onboarding
+	// Onboarding — only check when authenticated (endpoint requires auth)
 	const { data: onboardingComplete, isLoading: onboardingLoading } =
 		useOnboardingComplete();
 	const [wizardDismissed, setWizardDismissed] = useState(false);
@@ -152,7 +154,30 @@ function RootLayout() {
 			!(collectionSearch as Record<string, string>).tab ||
 			(collectionSearch as Record<string, string>).tab === "gear");
 
-	// Show a minimal loading state while checking onboarding status
+	// Show loading while checking auth
+	if (authLoading) {
+		return (
+			<div className="min-h-screen bg-gray-50 flex items-center justify-center">
+				<div className="w-6 h-6 border-2 border-gray-600 border-t-transparent rounded-full animate-spin" />
+			</div>
+		);
+	}
+
+	// Redirect unauthenticated users to login (server-side OIDC route)
+	// Allow public routes through without auth
+	const isPublicRoute =
+		location.pathname.startsWith("/users/") || location.pathname === "/login";
+
+	if (!isAuthenticated && !isPublicRoute) {
+		window.location.href = "/login";
+		return (
+			<div className="min-h-screen bg-gray-50 flex items-center justify-center">
+				<p className="text-sm text-gray-500">Redirecting to login...</p>
+			</div>
+		);
+	}
+
+	// Show loading while checking onboarding status
 	if (onboardingLoading) {
 		return (
 			<div className="min-h-screen bg-gray-50 flex items-center justify-center">