feat: remove login requirements for internal home-network use

- backend/app/security.py: require_session() now auto-authenticates by
  returning the first family_profile_id from the DB. No cookie or password
  needed. Falls back to "bootstrap" sentinel if no FamilyProfile exists.
  Admin routes (require_admin) still protected by bearer token.
- frontend/src/api/index.ts: removed 401→/login redirect interceptor
- frontend/src/App.tsx: removed Sign out button, removed /login route and
  Login page import
- Login page kept on disk (unused) for potential future re-enablement

frontend/src/App.tsx

@@ -5,8 +5,6 @@ import Dashboard from './pages/Dashboard'
 import MealDetail from './pages/MealDetail'
 import Pantry from './pages/Pantry'
 import ShoppingList from './pages/ShoppingList'
-import Login from './pages/Login'
-import { mealPlannerApi } from './api'
 
 const queryClient = new QueryClient()
 
@@ -30,17 +28,6 @@ function Navigation() {
             <Link to="/pantry" className={linkClass('/pantry')}>Pantry</Link>
             <Link to="/shopping-list" className={linkClass('/shopping-list')}>Shopping List</Link>
           </div>
-          <div className="flex items-center">
-            <button
-              onClick={async () => {
-                await mealPlannerApi.auth.logout().catch(() => {})
-                window.location.href = '/login'
-              }}
-              className="text-sm font-medium text-surface-500 hover:text-surface-900 px-3 py-2 rounded-lg hover:bg-surface-100 transition-colors"
-            >
-              Sign out
-            </button>
-          </div>
         </div>
       </div>
     </nav>
@@ -60,7 +47,6 @@ function App() {
                 <Route path="/meals/:id" element={<MealDetail />} />
                 <Route path="/pantry" element={<Pantry />} />
                 <Route path="/shopping-list" element={<ShoppingList />} />
-                <Route path="/login" element={<Login />} />
               </Routes>
             </main>
           </div>

frontend/src/api/index.ts

@@ -10,16 +10,6 @@ const api = axios.create({
   withCredentials: true,
 })
 
-api.interceptors.response.use(
-  response => response,
-  error => {
-    if (error.response?.status === 401 && window.location.pathname !== '/login') {
-      window.location.href = '/login'
-    }
-    return Promise.reject(error)
-  }
-)
-
 export const mealPlannerApi = {
   auth: {
     login: (password: string) => api.post('/auth/login', { password }),