fix(web): remove identity simulation and stop sending X-User-ID

Product UI no longer switches sessions locally; API clients attach Bearer
tokens only and LocalAuthClient stays test-only outside the prod bundle.

web/src/api/auth.test.ts

@@ -1,8 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import {
-  createInMemoryAuthClient,
-} from './auth';
+import { createInMemoryAuthClient } from './auth.local';
 
 test('AuthClient: 基础登录与 .env 超级管理员鉴权', async () => {
   const client = createInMemoryAuthClient({
@@ -23,7 +21,7 @@ test('AuthClient: 基础登录与 .env 超级管理员鉴权', async () => {
   const session = await client.login({ username: 'admin', password: 'admin-password-123' });
   assert.equal(session.user.username, 'admin');
   assert.equal(session.user.roleId, 'role-admin');
-  assert.equal(session.allowDevSwitch, true);
+  assert.equal(session.env, 'dev');
   assert.ok(session.token.length > 0);
 });