feat: add AUTH_DISABLED no-auth fallback mode

- config.py: AUTH_DISABLED: bool = False setting
- middleware/auth.py: bypass all checks when AUTH_DISABLED=True
- security.py: require_admin_auth returns synthetic context when disabled
- endpoints/auth.py: /me returns synthetic admin; /sign-out → / when disabled
- main.py: startup WARNING when disabled; pass auth_disabled to login.html
- templates/login.html: info banner with Go to dashboard link when disabled
- templates/setup.html: document AUTH_DISABLED option with security warning
- tests/test_auth.py: 4 new AUTH_DISABLED tests (445 total, all pass)

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/18f41bf2-0b68-4b7d-afb5-d2894c212a8f

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/core/config.py

@@ -54,6 +54,15 @@ class Settings(BaseSettings):
     # Use: openssl rand -hex 32
     ADMIN_API_KEY: Optional[str] = None
 
+    # ── Authentication mode ───────────────────────────────────────────────────
+    # Set AUTH_DISABLED=true to run without any authentication.
+    # Every request is treated as an anonymous admin.
+    #
+    # ⚠️  Only use this for local development or deployments that are protected
+    #     by an external auth proxy (e.g. Authelia, OAuth2 Proxy, Traefik Forward Auth).
+    #     Never expose an AUTH_DISABLED instance directly to the internet.
+    AUTH_DISABLED: bool = False
+
     # ── Logto OIDC ────────────────────────────────────────────────────────────
     # Set these to enable Logto-based authentication.
     # LOGTO_ENDPOINT:    the base URL of your Logto instance,