fix(GRO-778): exempt /dev-session from validatePortalSession middleware

Route ordering: /dev-session is registered after portalRouter.use("/*")
so it is NOT subject to the validatePortalSession/portalAudit middleware
chain — this is correct Hono behaviour since use() only applies to routes
registered after it.

The /dev-session POST endpoint creates the impersonation session and
cannot have a valid X-Impersonation-Session-Id header at call time.
Without this exemption, POST /api/portal/dev-session returns 401 before
the handler runs, breaking all portal pages when AUTH_DISABLED=true.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/routes/portal.ts

@@ -9,7 +9,9 @@ import type { PortalEnv } from "../middleware/portalSession.js";
 
 export const portalRouter = new Hono<PortalEnv>();
 
-// Apply middleware to all portal routes
+// Apply middleware to all portal routes — NOTE: /dev-session is registered BEFORE this line
+// so it is NOT subject to validatePortalSession/portalAudit (this is intentional: the endpoint
+// creates the impersonation session and has no X-Impersonation-Session-Id header yet).
 portalRouter.use("/*", validatePortalSession, portalAudit);
 
 // ─── GET routes ──────────────────────────────────────────────────────────────