fix(auth): dispatch honours the factory-resolved opt-out again

[chernistry]

Problem

SSOAuthMiddleware.dispatch gates its unauthenticated pass-through on auth_disabled_via_opt_out() alone — a live read of BERNSTEIN_AUTH_DISABLED. The constructor still resolves the factory argument (auth.enabled: false in configuration arrives as auth_disabled=True) into self._auth_disabled, but nothing reads that attribute any more. The regression shipped inside #4577, which is about skill collision guards; the middleware line was unrelated to that change.

Net effect: a deployment that disables auth by configuration logs the loud "auth is DISABLED" warning at startup and then returns 401 on every protected route anyway. The documented opt-out surface (docs/security/manager-auth.md) no longer matched behaviour.

Fix

Dispatch honours both signals:

if self._auth_disabled or auth_disabled_via_opt_out():

The live environment read is kept on purpose — a variable exported after the middleware stack is built still counts, which is the one property the #4577 change added.

Tests

• test_config_resolved_opt_out_survives_without_the_env_var — auth_disabled=True from the factory bypasses the gate with no env var set; fails before this fix.
• test_env_opt_out_set_after_construction_still_counts — pins the live-read property so honouring the flag cannot regress the env path.

Both run in the existing test_auth_middleware_defaults.py suite (33 passed).