feat: remove login requirements for internal home-network use

- backend/app/security.py: require_session() now auto-authenticates by
  returning the first family_profile_id from the DB. No cookie or password
  needed. Falls back to "bootstrap" sentinel if no FamilyProfile exists.
  Admin routes (require_admin) still protected by bearer token.
- frontend/src/api/index.ts: removed 401→/login redirect interceptor
- frontend/src/App.tsx: removed Sign out button, removed /login route and
  Login page import
- Login page kept on disk (unused) for potential future re-enablement

frontend/src/api/index.ts

@@ -10,16 +10,6 @@ const api = axios.create({
   withCredentials: true,
 })
 
-api.interceptors.response.use(
-  response => response,
-  error => {
-    if (error.response?.status === 401 && window.location.pathname !== '/login') {
-      window.location.href = '/login'
-    }
-    return Promise.reject(error)
-  }
-)
-
 export const mealPlannerApi = {
   auth: {
     login: (password: string) => api.post('/auth/login', { password }),