feat(web): add Auth seam (interface + StubAuth) for parallel UI build

Lets the Dex session layer (lane B) and page handlers (lane C) build independently:
handlers depend only on web.Auth; oidc.DexAuth (B) and StubAuth (dev) implement it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/auth.go

@@ -0,0 +1,39 @@
+// Package web is the Stage-0 HTTP read/write surface (ADR-011, docs/ui-spec.md).
+// It serves the summary reader over the existing store; the engine and ports are
+// untouched (ADR-003).
+//
+// This file defines the auth SEAM so the Dex session layer (internal/web/oidc)
+// and the page/handler layer can be built independently: handlers depend only on
+// the Auth interface, never on a concrete provider. StubAuth is the allow-all
+// dev/test impl; oidc.DexAuth is the production impl wired in cmd/tapir.
+package web
+
+import "net/http"
+
+// User is the authenticated principal. Subject is the Dex subject used for the
+// single-user allowlist (ADR-011); store operations key off the configured
+// tapir user_id (UUID), not this subject.
+type User struct {
+	Subject string
+	Email   string
+}
+
+// Auth gates routes and exposes the current user. Implementations: StubAuth
+// (dev/test, allow-all) and oidc.DexAuth (Dex OIDC session, lane B).
+type Auth interface {
+	// Middleware wraps h, redirecting/refusing unauthenticated requests.
+	Middleware(h http.Handler) http.Handler
+	// CurrentUser returns the authenticated user for a request.
+	CurrentUser(r *http.Request) (User, bool)
+	// Routes returns the auth endpoints to mount under /auth/ (login, callback,
+	// logout). StubAuth returns an empty mux.
+	Routes() http.Handler
+}
+
+// StubAuth allows every request as a fixed user. Default for local dev/tests;
+// replaced by oidc.DexAuth when Dex config is present (decided in cmd/tapir).
+type StubAuth struct{ U User }
+
+func (s StubAuth) Middleware(h http.Handler) http.Handler { return h }
+func (s StubAuth) CurrentUser(*http.Request) (User, bool) { return s.U, true }
+func (s StubAuth) Routes() http.Handler                   { return http.NewServeMux() }