auth: split dev-mode auth constructor and wire up dev-login/logout UI

Squeamish about New()'s empty-domain-string sentinel for "dev mode, skip
OIDC discovery" - split into New (always makes a real OIDC discovery
call, all params required) and NewDev (no ctx/domain/credentials at all,
since none are used). main.go now branches on cfg.DevAuthEnabled to pick
the right constructor instead of main.go/config.go coordinating on when
it's safe to pass empty strings.

Also finishes out the dev-auth flow this enables: config.Load reads a
DEV_AUTH_ENABLED-aware env file and only requires Auth0 vars when dev
auth is off; a PORT config var replaces the hardcoded :8082; and the nav
UI (layout/index templates, ui router) points login/logout links at
/api/auth/dev-login and a new /api/auth/dev-logout route when dev auth
is enabled, so the whole login/logout loop works locally without a real
Auth0 app.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

main.go

@@ -78,17 +78,22 @@ func runApp(ctx context.Context, logger *logging.Logger) error {
 		return fmt.Errorf("failed to initialize database connection pool: %w", err)
 	}
 
-	auth, err := authentication.New(
-		ctx,
-		connPool,
-		logger.WithGroup("authenticator"),
-		cfg.Auth0Domain,
-		cfg.Auth0ClientID,
-		cfg.Auth0ClientSecret,
-		cfg.Auth0CallbackURL,
-	)
-	if err != nil {
-		return fmt.Errorf("failed to construct authenticator: %w", err)
+	var auth *authentication.Authenticator
+	if cfg.DevAuthEnabled {
+		auth = authentication.NewDev(connPool, logger.WithGroup("authenticator"))
+	} else {
+		auth, err = authentication.New(
+			ctx,
+			connPool,
+			logger.WithGroup("authenticator"),
+			cfg.Auth0Domain,
+			cfg.Auth0ClientID,
+			cfg.Auth0ClientSecret,
+			cfg.Auth0CallbackURL,
+		)
+		if err != nil {
+			return fmt.Errorf("failed to construct authenticator: %w", err)
+		}
 	}
 
 	accts := accounts.NewStore(logger.WithGroup("accounts"), connPool)
@@ -240,7 +245,7 @@ func runServer(
 	)
 
 	srv := &http.Server{
-		Addr:    ":8082", // local
+		Addr:    fmt.Sprintf(":%d", cfg.Port), // local
 		Handler: r,
 	}
 
@@ -253,7 +258,7 @@ func runServer(
 		defer cancel()
 		defer close(alreadyShutdownCh)
 
-		logger.Info("server running on 8082...")
+		logger.Infof("server running on %d...", cfg.Port)
 		if err := srv.ListenAndServe(); err != nil {
 			if !errors.Is(err, http.ErrServerClosed) {
 				runningErrCh <- fmt.Errorf("server experienced error: %w", err)