fix: OIDC auth flow, Vite proxy, and PostgreSQL query compat

- Add auth redirect in root layout for unauthenticated users
- Proxy OIDC routes (/login, /callback, /logout) through Vite dev server
- Strip Secure flag from OIDC cookies in dev mode (HTTP localhost)
- Disable retry on auth query to prevent stale cookie loops
- Fix SQLite .get()/.all()/.run() calls in category and global-item
  services for PostgreSQL compatibility
- Add userId scoping to category service functions
- Add OIDC error logging in auth middleware
- Apply linter auto-formatting across affected files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vite.config.ts

@@ -18,6 +18,11 @@ export default defineConfig({
 		proxy: {
 			"/api": "http://localhost:3000",
 			"/uploads": "http://localhost:3000",
+			"/login": { target: "http://localhost:3000", changeOrigin: false },
+			"/callback": { target: "http://localhost:3000", changeOrigin: false },
+			"/logout": { target: "http://localhost:3000", changeOrigin: false },
+			"/.well-known": "http://localhost:3000",
+			"/oauth": "http://localhost:3000",
 		},
 	},
 	build: {