feat(frontend): in-page Casdoor login form + env-gated Developer Mode panel

- redesigned /login (Tailwind, RTL): centered username/password/organization
  form posting to POST /api/v1/auth/login — session starts without leaving
  the page; PM lands on the inventory panel, others on the procurement office
- Developer Mode button fixed top-left opens a role/project test panel
  (admin role added) gated by VITE_ENABLE_DEV_LOGIN (DEV_LOGIN_ENABLED build
  arg in Docker, default enabled)
- removed the old Casdoor redirect button, the PKCE ?code= callback, and the
  public casdoor-config.js — the client secret is no longer shipped to the
  browser; backend mediates the password grant instead

frontend/public/casdoor-config.js

@@ -1,9 +0,0 @@
-// تنظیمات اتصال به Casdoor — v2.6 (مقادیر همان نسخه‌ی ارسالی داشبورد)
-window.CASDOOR_CONFIG = {
-  serverUrl: "http://localhost:8080",
-  clientId: "inventory-app-client",
-  clientSecret: "inventory-app-secret-2026",
-  organization: "inventory",
-  appName: "inventory-app",
-  redirectUri: "http://localhost:3000/login"
-};