auth: split dev-mode auth constructor and wire up dev-login/logout UI

Squeamish about New()'s empty-domain-string sentinel for "dev mode, skip
OIDC discovery" - split into New (always makes a real OIDC discovery
call, all params required) and NewDev (no ctx/domain/credentials at all,
since none are used). main.go now branches on cfg.DevAuthEnabled to pick
the right constructor instead of main.go/config.go coordinating on when
it's safe to pass empty strings.

Also finishes out the dev-auth flow this enables: config.Load reads a
DEV_AUTH_ENABLED-aware env file and only requires Auth0 vars when dev
auth is off; a PORT config var replaces the hardcoded :8082; and the nav
UI (layout/index templates, ui router) points login/logout links at
/api/auth/dev-login and a new /api/auth/dev-logout route when dev auth
is enabled, so the whole login/logout loop works locally without a real
Auth0 app.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

templates/pages/index.html.tmpl

@@ -1,4 +1,5 @@
 {{- $loggedIn := and (and .Identity .Identity.AccessToken) true -}}
+{{- $devAuthEnabled := .DevAuthEnabled }}
 
 
 <section class="flex justify-center max-w-full mt-[3em] mb-[3em]">
@@ -26,7 +27,7 @@
 				Create an Account
 			</a>
 		{{- else }}
-			<a href="/api/auth/login" hx-boost="false" class="block p-[1em] font-bold">
+			<a href="/api/auth/{{if $devAuthEnabled}}dev-login{{else}}login{{end}}" hx-boost="false" class="block p-[1em] font-bold">
 				New Login
 			</a>
 		{{- end }}