deploy: pipe DEV_AUTH_BYPASS into the Vite build

Vite inlines import.meta.env.VITE_DEV_AUTH_BYPASS at build time. The
build container wasn't getting it, so even with DEV_AUTH_BYPASS=true on
the backend the SPA still rendered the MSAL login gate.

Resolve VITE_DEV_AUTH_BYPASS, falling back to DEV_AUTH_BYPASS if it's
not explicitly set, and pass it through `docker run -e` to the build.
A single DEV_AUTH_BYPASS=true in .env now controls both halves.

deploy/deploy.sh

@@ -211,10 +211,19 @@ docker compose up -d
 # ---------- 6. Frontend build + sync ----------
 
 if (( DO_FRONTEND )); then
-    log "Building Vite SPA in a one-shot node:20 container…"
+    # VITE_DEV_AUTH_BYPASS controls whether the SPA renders the MSAL login
+    # gate (false → MSAL, true → straight to the app). Mirror DEV_AUTH_BYPASS
+    # so a single env var decides both sides.
+    VITE_BYPASS=$(get_env_var VITE_DEV_AUTH_BYPASS)
+    if [[ -z "$VITE_BYPASS" ]]; then
+        VITE_BYPASS=$(get_env_var DEV_AUTH_BYPASS)
+    fi
+    [[ -z "$VITE_BYPASS" ]] && VITE_BYPASS="false"
+    log "Building Vite SPA (VITE_DEV_AUTH_BYPASS=${VITE_BYPASS}) in a one-shot node:20 container…"
     docker run --rm \
         -v "$REPO_ROOT/frontend:/app" \
         -w /app \
+        -e VITE_DEV_AUTH_BYPASS="$VITE_BYPASS" \
         node:20-alpine \
         sh -c "npm install --silent && npm run build"