fix: OIDC auth flow, Vite proxy, and PostgreSQL query compat

- Add auth redirect in root layout for unauthenticated users
- Proxy OIDC routes (/login, /callback, /logout) through Vite dev server
- Strip Secure flag from OIDC cookies in dev mode (HTTP localhost)
- Disable retry on auth query to prevent stale cookie loops
- Fix SQLite .get()/.all()/.run() calls in category and global-item
  services for PostgreSQL compatibility
- Add userId scoping to category service functions
- Add OIDC error logging in auth middleware
- Apply linter auto-formatting across affected files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/services/item.service.ts

@@ -1,5 +1,5 @@
 import { and, eq } from "drizzle-orm";
-import { db as prodDb } from "../../db/index.ts";
+import type { db as prodDb } from "../../db/index.ts";
 import { categories, items } from "../../db/schema.ts";
 import type { CreateItem } from "../../shared/types.ts";
 
@@ -146,9 +146,7 @@ export async function deleteItem(db: Db, userId: number, id: number) {
 
 	if (!item) return null;
 
-	await db
-		.delete(items)
-		.where(and(eq(items.id, id), eq(items.userId, userId)));
+	await db.delete(items).where(and(eq(items.id, id), eq(items.userId, userId)));
 
 	return item;
 }