fix: prevent admin escalation when AUTH_ENABLED=false

When auth was disabled, users could log out, reach the login page,
and authenticate with the default admin/admin credentials to gain
full admin privileges — defeating the purpose of AUTH_ENABLED=false.

Defense-in-depth fix across five layers:
- Skip ensureDefaultAdmin() when auth is disabled (no admin user seeded)
- Return 403 from POST /api/auth/login when auth is disabled
- Return synthetic anonymous user from GET /api/auth/session when auth is disabled
- Hide logout button in settings when auth is disabled
- Redirect /login and /change-password to / via AuthGuard when auth is disabled

Closes #90

apps/web/src/App.tsx

@@ -87,9 +87,7 @@ function AuthGuard({ children }: { children: React.ReactNode }) {
   const setStoreConsent = useAnalyticsStore((s) => s.setConsent);
   const location = useLocation();
 
-  // Hydrate the analytics store from session data on initial load.
-  // Only hydrate if the store is still in its initial state (user hasn't taken
-  // an explicit action like accepting/declining on the consent page).
+  // biome-ignore lint/correctness/useExhaustiveDependencies: only hydrate on session load, not on store changes
   useEffect(() => {
     if (
       !loading &&
@@ -103,9 +101,17 @@ function AuthGuard({ children }: { children: React.ReactNode }) {
         analyticsConsentRemindAt: null,
       });
     }
-    // eslint-disable-next-line -- only hydrate on session load, not on store changes
   }, [loading, analyticsEnabled, analyticsConsentShownAt, setStoreConsent]);
 
+  // When auth is disabled, redirect away from login/change-password to prevent escalation
+  if (
+    !loading &&
+    !authEnabled &&
+    (location.pathname === "/login" || location.pathname === "/change-password")
+  ) {
+    return <Navigate to="/" replace />;
+  }
+
   // Don't guard the login or change-password pages
   if (
     location.pathname === "/login" ||