Preserve debug auth override on reload

[evandhoffman]

Summary

• add an explicit debug_override path for create_app(...)
• pass scripts/serve.py --debug through that override so auth reload keeps debug mode active
• add regression coverage for an auth-enabled config_path reload under debug mode

Root Cause

scripts/serve.py --debug only mutated the in-memory config before app creation. Request-time auth checks reload config_path from disk, so the CLI-only webapp.debug setting was discarded and protected upload routes could require auth despite the debug launch flag.

Closes #45.

Tests

• uv run pytest tests/test_api_videos.py::test_debug_override_survives_config_path_auth_reload --no-cov
• uv run pytest tests/test_api_videos.py --no-cov
• uv run pytest --no-cov
• uv run ruff check
• uv run ruff format --check