Local identity mode is discarded by auth_routes

[Galaxy-Husky]

Summary

When the auth router is configured with AuthIdentityMode::Local, anonymous requests to GET /api/auth/user return 401 Unauthorized instead of resolving to the local default user.

Reproduction

1. Build an AuthRouterState with identity_mode: AuthIdentityMode::Local and aionpro_mode: false.
2. Build the router with auth_routes(state).
3. Send GET /api/auth/user without a bearer token or session cookie.

Reproduced on main at 8d6f6ccdbbadd69fb45a60b5cc135f256bd7359b.

Actual behavior

The endpoint returns 401 Unauthorized.

Expected behavior

Local mode should bypass JWT verification and return 200 OK with the fixed local identity:

{
  "success": true,
  "user": {
    "id": "system_default_user",
    "username": "system_default_user"
  }
}

Root cause

auth_routes ignores AuthRouterState.identity_mode when constructing its middleware AuthState. It derives the mode only from aionpro_mode, so every non-AionPro configuration becomes AuthIdentityMode::UserSession, including local mode.

Proposed fix

Pass state.identity_mode through to the middleware AuthState and add a route-level regression test for an anonymous local-mode request.

This preserves the existing 401 behavior for anonymous requests in UserSession mode and only enables the existing local-mode middleware behavior when the router is explicitly configured for Local identity.