feat: add AUTH_DISABLED no-auth fallback mode

- config.py: AUTH_DISABLED: bool = False setting
- middleware/auth.py: bypass all checks when AUTH_DISABLED=True
- security.py: require_admin_auth returns synthetic context when disabled
- endpoints/auth.py: /me returns synthetic admin; /sign-out → / when disabled
- main.py: startup WARNING when disabled; pass auth_disabled to login.html
- templates/login.html: info banner with Go to dashboard link when disabled
- templates/setup.html: document AUTH_DISABLED option with security warning
- tests/test_auth.py: 4 new AUTH_DISABLED tests (445 total, all pass)

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/18f41bf2-0b68-4b7d-afb5-d2894c212a8f

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/core/security.py

@@ -170,13 +170,18 @@ async def require_admin_auth(
     Dependency to require authentication for admin/API endpoints.
 
     Accepts (in priority order):
-    1. ``dmarq_session`` cookie – set after a successful Logto login.
-    2. ``X-API-Key`` header    – static admin key for programmatic access.
-    3. ``Authorization: Bearer <token>`` header – app-issued JWT.
+    1. ``AUTH_DISABLED=true`` env var – passes through with a synthetic context.
+    2. ``dmarq_session`` cookie – set after a successful Logto login.
+    3. ``X-API-Key`` header    – static admin key for programmatic access.
+    4. ``Authorization: Bearer <token>`` header – app-issued JWT.
 
     Returns an authentication context dict describing how the request was
     authenticated.  Raises ``HTTP 401`` when no valid credential is present.
     """
+    # 0. Auth globally disabled
+    if settings.AUTH_DISABLED:
+        return {"auth_type": "disabled"}
+
     # 1. Session cookie (Logto-backed app session)
     from app.core.logto import SESSION_COOKIE, decode_session_token  # local import