Claude-assisted improvements (untested)

- dev auth flow (side-step OAuth)
- db event processing integration tests
- dev scripts (eg Makefile)
- db / test db migration setup scripts.

server/api/auth/router.go

@@ -21,6 +21,7 @@ func Routes(
 	r *gin.RouterGroup,
 	logger *logging.Logger,
 	auth *authentication.Authenticator,
+	devAuthEnabled bool,
 ) {
 	ls := &loginSubrouter{
 		log:  logger,
@@ -30,6 +31,11 @@ func Routes(
 	r.GET("/login", response.Handler(ls.loginPage))
 	r.GET("/login/callback", response.Handler(ls.loginCallback))
 	r.GET("/logout", response.Handler(ls.logoutPage))
+
+	if devAuthEnabled {
+		logger.Warn("DEV_AUTH_ENABLED is set: /api/auth/dev-login is live and lets any caller authenticate as any user_id with no credentials. Never enable this outside local development.")
+		r.GET("/dev-login", response.Handler(ls.devLoginPage))
+	}
 }
 
 func (s *loginSubrouter) loginPage(c *gin.Context) (response.Response, error) {
@@ -75,6 +81,43 @@ func (s *loginSubrouter) loginCallback(c *gin.Context) (response.Response, error
 		Cookie(cookies.AccessToken(accessToken, expiration)), nil
 }
 
+// devLoginPage mints a local session for a user_id, skipping the real Auth0
+// OAuth round-trip. Only registered when devAuthEnabled is passed to Routes.
+//
+// Query params:
+//   - user_id: identity to log in as (default "dev-user"); use different
+//     values to test multiple accounts side by side.
+//   - name: display name for the identity (default derived from user_id).
+//   - target: where to redirect after login (default "/").
+func (s *loginSubrouter) devLoginPage(c *gin.Context) (response.Response, error) {
+	r := c.Request
+	ctx := r.Context()
+	q := r.URL.Query()
+
+	userID := q.Get("user_id")
+	if userID == "" {
+		userID = "dev-user"
+	}
+
+	name := q.Get("name")
+	if name == "" {
+		name = "Dev User (" + userID + ")"
+	}
+
+	targetURI := q.Get("target")
+	if targetURI == "" {
+		targetURI = "/"
+	}
+
+	accessToken, expiration, err := s.auth.DevLogin(ctx, userID, name)
+	if err != nil {
+		return nil, response.Errorf("failed to create dev session: %w", err)
+	}
+
+	return response.TemporaryRedirect(targetURI).
+		Cookie(cookies.AccessToken(accessToken, expiration)), nil
+}
+
 func (s *loginSubrouter) logoutPage(c *gin.Context) (response.Response, error) {
 	r := c.Request