fix: seed anonymous user row in DB and add comprehensive test coverage

When AUTH_ENABLED=false, seed an "anonymous" user row in the users
table so API keys, pipelines, and user files don't fail with FK
constraint violations. Previously, the synthetic anonymous user only
existed in memory (attached by the middleware), but any DB operation
referencing userId "anonymous" would violate foreign key constraints.

Also adds 25 new tests covering:
- Integration: ensureAnonymousUser, FK constraints, settings save,
  API key and pipeline operations for anonymous mode
- Frontend: useAuth hook anonymous happy path (role, permissions,
  hasPermission, session endpoint bypass)
- Frontend: settings dialog nav filtering (authRequired hides
  security/people/teams/roles when auth disabled)
- Backend: session endpoint returns admin role when auth disabled

tests/unit/api/anonymous-admin.test.ts

@@ -44,7 +44,7 @@ vi.mock("../../../apps/api/src/lib/audit.js", () => ({
 
 import Fastify from "fastify";
 import { hasPermission } from "../../../apps/api/src/permissions.js";
-import { authMiddleware, getAuthUser } from "../../../apps/api/src/plugins/auth.js";
+import { authMiddleware, authRoutes, getAuthUser } from "../../../apps/api/src/plugins/auth.js";
 
 describe("anonymous user when AUTH_ENABLED=false", () => {
   it("assigns admin role to anonymous user", async () => {
@@ -106,3 +106,37 @@ describe("anonymous user when AUTH_ENABLED=false", () => {
     expect((reply as { status: ReturnType<typeof vi.fn> }).status).not.toHaveBeenCalled();
   });
 });
+
+describe("session endpoint when AUTH_ENABLED=false", () => {
+  it("GET /api/auth/session returns admin role", async () => {
+    const app = Fastify({ logger: false });
+
+    await authMiddleware(app);
+    await authRoutes(app);
+    await app.ready();
+
+    const res = await app.inject({ method: "GET", url: "/api/auth/session" });
+    await app.close();
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body.user.role).toBe("admin");
+    expect(body.user.username).toBe("anonymous");
+    expect(body.user.permissions).toContain("settings:write");
+    expect(body.user.permissions).toContain("users:manage");
+  });
+
+  it("GET /api/auth/session returns null expiresAt", async () => {
+    const app = Fastify({ logger: false });
+
+    await authMiddleware(app);
+    await authRoutes(app);
+    await app.ready();
+
+    const res = await app.inject({ method: "GET", url: "/api/auth/session" });
+    await app.close();
+
+    const body = JSON.parse(res.body);
+    expect(body.expiresAt).toBeNull();
+  });
+});