fix: OIDC auth flow, Vite proxy, and PostgreSQL query compat

- Add auth redirect in root layout for unauthenticated users
- Proxy OIDC routes (/login, /callback, /logout) through Vite dev server
- Strip Secure flag from OIDC cookies in dev mode (HTTP localhost)
- Disable retry on auth query to prevent stale cookie loops
- Fix SQLite .get()/.all()/.run() calls in category and global-item
  services for PostgreSQL compatibility
- Add userId scoping to category service functions
- Add OIDC error logging in auth middleware
- Apply linter auto-formatting across affected files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/middleware/auth.ts

@@ -39,7 +39,8 @@ export async function requireAuth(c: Context, next: Next) {
 			c.set("userId", user.id);
 			return next();
 		}
-	} catch {
+	} catch (err) {
+		console.error("[auth] OIDC auth failed:", err);
 		// OIDC not configured or session invalid — fall through
 	}