fix(word-addin): remove the guest sign-in flow that calls a nonexistent endpoint

WHY THIS MATTERS
The login page rendered a "Continue as guest" button in every
non-production build. Clicking it POSTed to `${API_BASE_URL}/auth/guest`
- an endpoint that does not exist anywhere in this repository (the
backend has no auth router at all; authentication is delegated entirely
to Supabase's token grants). So the button could never succeed: every
click ended in a fetch error dressed up as "Guest login is unavailable".
Worse, the comments around it claimed the endpoint "mirrors the web app"
and "is gated to non-production on the server too" - statements that are
simply false for this codebase. Dead UI is bad; dead UI with
authoritative-sounding comments is a trap for the next contributor, who
will reasonably go hunting for a server route that was never there.

WHAT IS DEAD-ENDPOINT DRIFT
Client code often outlives (or predates) the server contract it was
written against. When a client keeps calling a route the server never
implements, you get "dead-endpoint drift": the code typechecks, the UI
renders, and the failure only shows up as a runtime network error - the
compiler cannot save you because HTTP paths are just strings:

  // Typechecks fine. Fails 100% of the time at runtime:
  await fetch(`${API_BASE_URL}/auth/guest`, { method: "POST" });

The only defenses are (a) not shipping calls to routes you haven't
built, and (b) comments that describe what IS, not what you wish were.

HOW THE FIX WORKS
The whole guest path is deleted end-to-end so no layer references it:

  - session.ts: `signInAsGuest()` and the now-unused API_BASE_URL
    constant are removed (the session module talks only to Supabase;
    the Mike API base belongs to api/mikeApi.ts).
  - useAuth.ts: the `loginAsGuest` binding is dropped from AuthState.
  - LoginPage.tsx: the guest button, its NODE_ENV gate, and the false
    "server-gated" comment are gone; the page now offers exactly the
    one flow the backend supports - Supabase email/password sign-in.

If a real guest endpoint lands server-side someday, the flow can be
reintroduced against the actual contract instead of an imagined one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>