chore: disable backend JWT enforcement until FAM login exists

The frontend only has mock auth (no Cognito/Amplify integration), so it
cannot obtain tokens and every API call would 401. Run the backend with
security disabled — the scaffold's local-dev placeholder principal —
until FAM login is implemented in the frontend, then flip back to true.

Author: kamal-mohammed

backend/openshift.deploy.yml

@@ -127,8 +127,10 @@ objects:
                   value: openshift,oracle
                 - name: APP_VERSION
                   value: ${IMAGE_TAG}
+                # Interim: mock-auth frontend can't produce Cognito JWTs yet.
+                # Flip to "true" when FAM login lands in the frontend.
                 - name: ILCR_SECURITY_ENABLED
-                  value: "true"
+                  value: "false"
                 - name: ILCR_DATASOURCE_ENABLED
                   value: "true"
                 - name: ORACLEDB_HOST