fix(local_auth): define module logger to avoid NameError on admin bootstrap

[G2P2]

What is wrong

agentic_core/local_auth.py uses logger.warning(...) in _ensure_admin() (line 85 on main), but the module never imports logging and never defines logger. Every other module in agentic_core/ that logs does define one (e.g. cognito_auth.py:9, authing_auth.py:14, user_memory.py:13) — this one was missed.

How it fails

_ensure_admin() is called first thing in local_login() and in local_list_users(). It hits the logger.warning line whenever the admin user is not yet present in the config table and AGENTIC_AUTO_ADMIN_PASSWORD is unset — which is the default, since config/local_auth default it to "" and only deploy/china/deploy-cn.sh requires it. Note that _get_users() also swallows any DynamoDB error and returns {}, so a misconfigured or unreachable config table lands on the same path.

The result is an uncaught NameError instead of the intended warning:

File "agentic_core/local_auth.py", line 110, in local_login
    _ensure_admin()
File "agentic_core/local_auth.py", line 85, in _ensure_admin
    logger.warning("AGENTIC_AUTO_ADMIN_PASSWORD not set - skipping admin user creation")
NameError: name logger is not defined

POST /api/auth/local-login (api/main.py:3967) is an unauthenticated public path and does not catch this, so the endpoint returns HTTP 500 rather than the intended 401 with a clear error message. POST /api/auth/login has the same behaviour when AGENTIC_AUTO_AUTH_PROVIDER is local or authing.

The fix

Add import logging and logger = logging.getLogger(__name__), matching the pattern used by the sibling modules. Three added lines, no behaviour change beyond the intended warning now being emitted.

Verification

Ran local_auth.py in a clean Python 3.13 container with AGENTIC_AUTO_ADMIN_PASSWORD unset and no DynamoDB reachable.

Before: NameError: name logger is not defined (traceback above).

After:

AGENTIC_AUTO_ADMIN_PASSWORD not set - skipping admin user creation
RESULT: {error: user does not exist}

so the caller gets the error dict it expects and the endpoint can return 401. python -m py_compile agentic_core/local_auth.py also passes.

I did not exercise the full happy path (successful login writing to a real DynamoDB config table), as that needs AWS credentials and a provisioned table.