fix: OIDC auth flow, Vite proxy, and PostgreSQL query compat

- Add auth redirect in root layout for unauthenticated users
- Proxy OIDC routes (/login, /callback, /logout) through Vite dev server
- Strip Secure flag from OIDC cookies in dev mode (HTTP localhost)
- Disable retry on auth query to prevent stale cookie loops
- Fix SQLite .get()/.all()/.run() calls in category and global-item
  services for PostgreSQL compatibility
- Add userId scoping to category service functions
- Add OIDC error logging in auth middleware
- Apply linter auto-formatting across affected files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/routes/global-items.test.ts

@@ -30,11 +30,7 @@ function insertGlobalItem(db: TestDb, brand: string, model: string) {
 }
 
 function insertItem(db: TestDb, name: string) {
-	return db
-		.insert(items)
-		.values({ name, categoryId: 1 })
-		.returning()
-		.get();
+	return db.insert(items).values({ name, categoryId: 1 }).returning().get();
 }
 
 describe("Global Item Routes", () => {