fix: OIDC auth flow, Vite proxy, and PostgreSQL query compat

- Add auth redirect in root layout for unauthenticated users
- Proxy OIDC routes (/login, /callback, /logout) through Vite dev server
- Strip Secure flag from OIDC cookies in dev mode (HTTP localhost)
- Disable retry on auth query to prevent stale cookie loops
- Fix SQLite .get()/.all()/.run() calls in category and global-item
  services for PostgreSQL compatibility
- Add userId scoping to category service functions
- Add OIDC error logging in auth middleware
- Apply linter auto-formatting across affected files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/routes/images.test.ts

@@ -16,7 +16,10 @@ mock.module("../../src/server/services/storage.service", () => ({
 
 // Also mock image service for from-url test
 const mockFetchImageFromUrl = mock(() =>
-	Promise.resolve({ filename: "test.png", sourceUrl: "https://example.com/img.png" }),
+	Promise.resolve({
+		filename: "test.png",
+		sourceUrl: "https://example.com/img.png",
+	}),
 );
 mock.module("../../src/server/services/image.service", () => ({
 	fetchImageFromUrl: mockFetchImageFromUrl,