feat: add AUTH_DISABLED no-auth fallback mode

- config.py: AUTH_DISABLED: bool = False setting
- middleware/auth.py: bypass all checks when AUTH_DISABLED=True
- security.py: require_admin_auth returns synthetic context when disabled
- endpoints/auth.py: /me returns synthetic admin; /sign-out → / when disabled
- main.py: startup WARNING when disabled; pass auth_disabled to login.html
- templates/login.html: info banner with Go to dashboard link when disabled
- templates/setup.html: document AUTH_DISABLED option with security warning
- tests/test_auth.py: 4 new AUTH_DISABLED tests (445 total, all pass)

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/18f41bf2-0b68-4b7d-afb5-d2894c212a8f

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/middleware/auth.py

@@ -56,6 +56,13 @@ class AuthRedirectMiddleware(BaseHTTPMiddleware):
     async def dispatch(self, request: Request, call_next) -> Response:  # type: ignore[override]
         path = request.url.path
 
+        # ── 0. Auth disabled globally ─────────────────────────────────────────
+        from app.core.config import get_settings  # local import avoids circular dep
+
+        cfg = get_settings()
+        if cfg.AUTH_DISABLED:
+            return await call_next(request)
+
         # ── 1. Public paths & prefixes ────────────────────────────────────────
         if path in _PUBLIC_PATHS:
             return await call_next(request)
@@ -68,9 +75,7 @@ class AuthRedirectMiddleware(BaseHTTPMiddleware):
             return await call_next(request)
 
         # ── 3. Logto not configured ───────────────────────────────────────────
-        from app.core.config import get_settings  # local import avoids circular dep
-
-        if not get_settings().logto_configured:
+        if not cfg.logto_configured:
             return RedirectResponse(url="/setup", status_code=302)
 
         # ── 4. Redirect to login ──────────────────────────────────────────────