feat: replace mock mode with real backend dev mode

Add --dev flag to `opal server start` that disables auth (injects
userID=1 for all requests) and exposes a /auth/dev-session endpoint,
so the frontend can develop against a real backend without OAuth
config. Remove VITE_MOCK_MODE and all mock data/branches from the
frontend stores. Add scripts/dev.sh to start both services locally.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

opal-task/cmd/server.go

@@ -97,20 +97,30 @@ var serverStartCmd = &cobra.Command{
 Examples:
   opal server start
   opal server start --addr :8080
+  opal server start --dev
   opal server start --db /var/lib/opal/opal.db`,
 	Run: func(cmd *cobra.Command, args []string) {
 		addr, _ := cmd.Flags().GetString("addr")
 		dbPath, _ := cmd.Flags().GetString("db")
+		devMode, _ := cmd.Flags().GetBool("dev")
 
 		// Override DB path if specified
 		if dbPath != "" {
 			os.Setenv("OPAL_DB_PATH", dbPath)
 		}
 
-		// Validate server configuration
-		if err := validateServerConfig(); err != nil {
-			fmt.Fprintf(os.Stderr, "Server configuration validation failed:\n%v\n", err)
-			os.Exit(1)
+		// In dev mode, skip OAuth config validation
+		if devMode {
+			fmt.Println("┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓")
+			fmt.Println("┃         ⚠  DEV MODE ENABLED  ⚠          ┃")
+			fmt.Println("┃  Auth disabled — all requests use uid 1  ┃")
+			fmt.Println("┃  Do NOT use in production!                ┃")
+			fmt.Println("┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛")
+		} else {
+			if err := validateServerConfig(); err != nil {
+				fmt.Fprintf(os.Stderr, "Server configuration validation failed:\n%v\n", err)
+				os.Exit(1)
+			}
 		}
 
 		// Load config (read-only — uses defaults if no opal.yml exists)
@@ -127,7 +137,7 @@ Examples:
 		defer engine.CloseDB()
 
 		// Create and start server
-		server := api.NewServer(addr)
+		server := api.NewServer(addr, devMode)
 		if err := server.Start(); err != nil {
 			fmt.Fprintf(os.Stderr, "Error starting server: %v\n", err)
 			os.Exit(1)
@@ -194,6 +204,7 @@ func init() {
 
 	serverStartCmd.Flags().StringP("addr", "a", ":8080", "Server address")
 	serverStartCmd.Flags().StringP("db", "d", "", "Database path (default: config directory)")
+	serverStartCmd.Flags().Bool("dev", false, "Enable dev mode (no auth, no OAuth env vars required)")
 
 	keygenCmd.Flags().StringP("name", "n", "", "Name for this API key (e.g., device name)")
 	keygenCmd.Flags().StringP("db", "d", "", "Database path (default: config directory)")