security(P0): fail-closed when auth is enabled but cannot initialize

Previously, if enable_auth=true but the database or auth services failed
to initialize, the server silently started in PUBLIC mode — all API routes
accessible without authentication. This is a critical fail-open bug.

Fixes (fail-closed behavior):
1. main.rs: DB pool creation failure with enable_auth=true now panics
   instead of falling through with db_pool=None
2. di.rs: create_auth_services() failure now propagates the error via ?
   instead of logging and continuing with auth_services=None
3. main.rs: Added defensive assert! that auth_service is Some when
   enable_auth=true, preventing any future refactor from reintroducing
   the silent degradation

The server will now refuse to start if authentication is configured
but cannot be properly initialized.

src/common/di.rs

@@ -459,21 +459,32 @@ impl AppServiceFactory {
 
             // Auth services
             if self.config.features.enable_auth {
-                match crate::infrastructure::auth_factory::create_auth_services(
+                let services = crate::infrastructure::auth_factory::create_auth_services(
                     &self.config,
                     pool.clone(),
                     Some(apps.folder_service_concrete.clone()),
                 )
                 .await
-                {
-                    Ok(services) => {
-                        tracing::info!("Authentication services initialized successfully");
-                        auth_services = Some(services);
-                    }
-                    Err(e) => {
-                        tracing::error!("Failed to initialize authentication services: {}", e);
-                    }
-                }
+                .map_err(|e| {
+                    // SECURITY: fail-closed. If auth is required but the auth
+                    // services cannot be created, propagate the error so the
+                    // server refuses to start — never degrade to public mode.
+                    tracing::error!(
+                        "FATAL: enable_auth=true but auth services failed to initialize: {}",
+                        e
+                    );
+                    DomainError::internal_error(
+                        "AuthInit",
+                        format!(
+                            "Authentication is enabled but auth services failed: {}. \
+                             Refusing to start without authentication.",
+                            e
+                        ),
+                    )
+                })?;
+
+                tracing::info!("Authentication services initialized successfully");
+                auth_services = Some(services);
             }
         }