Local identity mode is discarded by auth_routes

## Summary

When the auth router is configured with `AuthIdentityMode::Local`, anonymous requests to `GET /api/auth/user` return `401 Unauthorized` instead of resolving to the local default user.

## Reproduction

1. Build an `AuthRouterState` with `identity_mode: AuthIdentityMode::Local` and `aionpro_mode: false`.
2. Build the router with `auth_routes(state)`.
3. Send `GET /api/auth/user` without a bearer token or session cookie.

Reproduced on `main` at `8d6f6ccdbbadd69fb45a60b5cc135f256bd7359b`.

## Actual behavior

The endpoint returns `401 Unauthorized`.

## Expected behavior

Local mode should bypass JWT verification and return `200 OK` with the fixed local identity:

```json
{
"success": true,
"user": {
"id": "system_default_user",
"username": "system_default_user"
}
}
```

## Root cause

`auth_routes` ignores `AuthRouterState.identity_mode` when constructing its middleware `AuthState`. It derives the mode only from `aionpro_mode`, so every non-AionPro configuration becomes `AuthIdentityMode::UserSession`, including local mode.

## Proposed fix

Pass `state.identity_mode` through to the middleware `AuthState` and add a route-level regression test for an anonymous local-mode request.

This preserves the existing `401` behavior for anonymous requests in `UserSession` mode and only enables the existing local-mode middleware behavior when the router is explicitly configured for `Local` identity.

Start at the auth_routes entry point and trace how AuthRouterState becomes the middleware AuthState, focusing on identity_mode and aionpro_mode. Add a route-level regression test for an anonymous GET /api/auth/user request in Local mode; done means it returns 200 with the fixed local identity while UserSession still returns 401.

Written by the indexing model from the issue text.