feat(frontend): in-page Casdoor login form + env-gated Developer Mode panel

- redesigned /login (Tailwind, RTL): centered username/password/organization
  form posting to POST /api/v1/auth/login — session starts without leaving
  the page; PM lands on the inventory panel, others on the procurement office
- Developer Mode button fixed top-left opens a role/project test panel
  (admin role added) gated by VITE_ENABLE_DEV_LOGIN (DEV_LOGIN_ENABLED build
  arg in Docker, default enabled)
- removed the old Casdoor redirect button, the PKCE ?code= callback, and the
  public casdoor-config.js — the client secret is no longer shipped to the
  browser; backend mediates the password grant instead

frontend/src/store/auth.ts

@@ -1,7 +1,7 @@
 // ============================================================
-// Auth store — Casdoor OIDC + PKCE session (v2.6)
+// Auth store — Casdoor session (v2.6, درون‌صفحه‌ای / password grant)
 // Dev mode: no token — identity sent via X-User-Role/X-Project-Id
-// headers (backend dev fallback) so the dash works before Casdoor
+// headers (backend dev fallback) so the app works before Casdoor
 // is fully seeded.
 // ============================================================