fix: Add robustness improvements to approval, auth, and server

approval/store.go:
- Make Approve() idempotent - return success if already approved
- Handles double-clicks and race conditions gracefully

auth.go:
- Add dev mode admin bypass (disabled by default)
- When ALLOW_ADMIN_BYPASS=1, sets X-Authenticated-User header

server.go:
- Call router.StopOpenCodeAI() during shutdown
- Ensures AI service stops cleanly on server termination

internal/ai/approval/store.go

@@ -221,6 +221,11 @@ func (s *Store) Approve(id, username string) (*ApprovalRequest, error) {
 		return nil, fmt.Errorf("approval request not found: %s", id)
 	}
 
+	// Idempotent: if already approved, return success (handles double-clicks, race conditions)
+	if req.Status == StatusApproved {
+		return req, nil
+	}
+
 	if req.Status != StatusPending {
 		return nil, fmt.Errorf("approval request is not pending (status: %s)", req.Status)
 	}

internal/api/auth.go

@@ -183,6 +183,16 @@ func CheckProxyAuth(cfg *config.Config, r *http.Request) (bool, string, bool) {
 
 // CheckAuth checks both basic auth and API token
 func CheckAuth(cfg *config.Config, w http.ResponseWriter, r *http.Request) bool {
+	// Dev mode bypass for all auth (disabled by default)
+	if adminBypassEnabled() {
+		if w != nil {
+			// Set headers for standard admin user
+			w.Header().Set("X-Authenticated-User", "admin")
+			w.Header().Set("X-Auth-Method", "bypass")
+		}
+		return true
+	}
+
 	config.Mu.RLock()
 	defer config.Mu.RUnlock()
 

pkg/server/server.go

@@ -304,6 +304,9 @@ shutdown:
 		log.Error().Err(err).Msg("Server shutdown error")
 	}
 
+	// Stop OpenCode AI service (kills sidecar process group)
+	router.StopOpenCodeAI(shutdownCtx)
+
 	cancel()
 	reloadableMonitor.Stop()