feat(frontend): in-page Casdoor login form + env-gated Developer Mode panel

- redesigned /login (Tailwind, RTL): centered username/password/organization
  form posting to POST /api/v1/auth/login — session starts without leaving
  the page; PM lands on the inventory panel, others on the procurement office
- Developer Mode button fixed top-left opens a role/project test panel
  (admin role added) gated by VITE_ENABLE_DEV_LOGIN (DEV_LOGIN_ENABLED build
  arg in Docker, default enabled)
- removed the old Casdoor redirect button, the PKCE ?code= callback, and the
  public casdoor-config.js — the client secret is no longer shipped to the
  browser; backend mediates the password grant instead

frontend/src/lib/api.ts

@@ -1340,6 +1340,44 @@ export interface UserRow {
 }
 
 export const apiV26 = {
+  auth: {
+    // ورود درون‌صفحه‌ای: بک‌اند با grant_type=password از Casdoor توکن می‌گیرد
+    // و نقش/پروفایل را از جدول users خودمان برمی‌گرداند.
+    login: async (body: {
+      username: string;
+      password: string;
+      organization?: string;
+    }): Promise<{ access_token: string; expires_in: number | null; user: import("../store/auth").AuthUser }> => {
+      const res = await request<{
+        data: {
+          access_token: string;
+          token_type: string;
+          expires_in: number | null;
+          user: {
+            id: string;
+            casdoor_id: string;
+            first_name: string;
+            last_name: string;
+            phone: string | null;
+            role: "pm" | "procurement_manager" | "admin" | null;
+            role_label: string | null;
+            project_id: string | null;
+            project_name: string | null;
+          };
+        };
+      }>("/auth/login", { method: "POST", body: JSON.stringify(body) });
+      const u = res.data.user;
+      return {
+        access_token: res.data.access_token,
+        expires_in: res.data.expires_in,
+        user: {
+          ...u,
+          display_name: `${u.first_name} ${u.last_name}`.trim() || u.casdoor_id,
+        },
+      };
+    },
+  },
+
   lookup: {
     categories: async (): Promise<RawCat[]> => getData<RawCat[]>("/material-categories?page_size=100"),
     units: async (): Promise<RawUnitL[]> => getData<RawUnitL[]>("/units?page_size=100"),