fix: dev mode auth regression from blueprint refactor

The _initialized singleton in auth.py prevented hooks from registering
on the correct app instance when create_app() was called twice (once
eagerly at import, once from __main__). Removed the guard and made
the module-level app lazy. Also adds feature backlog and architecture
assessment from the review team.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/webui/app.py

@@ -78,8 +78,17 @@ def create_app(dev: bool = False) -> Flask:
     return application
 
 
-# Module-level app instance for backward compatibility (import from webui.app import app)
-app = create_app(dev=False)
+# Lazy module-level app for backward compatibility (import from webui.app import app)
+# Don't eagerly create — let __main__ or the importer control dev mode.
+app: Flask | None = None
+
+
+def get_app(dev: bool = False) -> Flask:
+    """Get or create the app singleton."""
+    global app
+    if app is None:
+        app = create_app(dev=dev)
+    return app
 
 
 if __name__ == "__main__":

src/webui/auth.py

@@ -19,7 +19,6 @@ from flask import abort, g
 
 # Module-level flag set by init_auth()
 _dev_mode: bool = False
-_initialized: bool = False
 
 
 def is_admin() -> bool:
@@ -38,14 +37,10 @@ def admin_required(f):
 
 
 def init_auth(app, dev: bool = False):
-    """Set the auth mode and register Flask hooks (once only)."""
-    global _dev_mode, _initialized
+    """Set the auth mode and register Flask hooks."""
+    global _dev_mode
     _dev_mode = dev
 
-    if _initialized:
-        return
-    _initialized = True
-
     @app.before_request
     def set_admin_flag():
         g.is_admin = is_admin()