Fail closed on missing auth config

[MaxGhenis]

Summary

• keep local auth-disabled mode available when auth.enabled is false
• raise at startup when auth.enabled is true but required Auth0 address or audience config is missing
• update the decorator unit test to assert fail-closed behaviour

Security impact

Prevents production from silently falling back to unauthenticated endpoints when an Auth0 secret or env var is missing.

Validation

• python -m py_compile policyengine_household_api/decorators/auth.py tests/unit/decorators/test_auth.py
• Pytest/import execution was attempted, but the local checkout is missing authlib / flask_cors dependencies.