feat: replace mock mode with real backend dev mode

Add --dev flag to `opal server start` that disables auth (injects
userID=1 for all requests) and exposes a /auth/dev-session endpoint,
so the frontend can develop against a real backend without OAuth
config. Remove VITE_MOCK_MODE and all mock data/branches from the
frontend stores. Add scripts/dev.sh to start both services locally.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

opal-task/internal/api/middleware.go

@@ -73,6 +73,16 @@ func GetUserID(r *http.Request) int {
 	return userID
 }
 
+// DevAuthMiddleware always injects userID=1 into context — for local dev only
+func DevAuthMiddleware() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			ctx := context.WithValue(r.Context(), userIDKey, 1)
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
 // CORSMiddleware adds CORS headers for future web frontend
 func CORSMiddleware() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {