feat: list + task endpoints and CORS, verified end-to-end

server/middleware/1.auth.ts

@@ -3,6 +3,13 @@ export default defineEventHandler(async (event) => {
   const path = getRequestURL(event).pathname;
   if (!path.startsWith("/api/")) return;
 
+  // Dev-only bypass for local smoke tests. `import.meta.dev` is false in production
+  // builds, so this branch is dead-code-eliminated and can never run when deployed.
+  if (import.meta.dev && process.env.AUTH_DEV_BYPASS === "1") {
+    event.context.user = { sub: "dev" };
+    return;
+  }
+
   // CORS preflight is answered (and short-circuited) by 0.cors.ts before this runs.
   const header = getHeader(event, "authorization") || "";
   const token = header.startsWith("Bearer ") ? header.slice(7).trim() : "";