feat(casdoor): seeder for current Casdoor version + wire api env and dev-login build arg

- seed_casdoor.py: JSON type=login + cookie session (the old form-encoded
  login-normal API is gone), application with grantTypes incl. password,
  passwordType=plain for the seeded users, idempotent re-runs; adds a
  dedicated tester user
- docker-compose: Casdoor env for the api service (endpoint casdoor:8000
  in-network, issuer http://localhost:8080 as advertised by discovery) and
  the DEV_LOGIN_ENABLED build arg for the frontend

docker-compose.yml

@@ -74,7 +74,9 @@ services:
   # v2.6 — Casdoor (OIDC identity provider)
   # Console: http://localhost:8080 (admin / 123)
   # Application "inventory-app" (org "inventory", client inventory-app-client)
-  # is seeded by casdoor/seed.py — see tools/seed_casdoor.py in the repo.
+  # is created by backend/tools/seed_casdoor.py — run it once after the
+  # first boot:
+  #   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
   # ==========================================================================
   casdoor-postgres:
     image: postgres:16
@@ -115,6 +117,15 @@ services:
       PROCUREMENT_MINIO_SECRET_KEY: minioadmin
       PROCUREMENT_MINIO_BUCKET: procurement-files
       PROCUREMENT_MINIO_SECURE: "false"
+      # Casdoor: endpoint is the in-network service URL; the issuer must match
+      # the origin Casdoor advertises to browsers (its OIDC discovery doc).
+      PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000
+      PROCUREMENT_CASDOOR_ISSUER: http://localhost:8080
+      PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client
+      PROCUREMENT_CASDOOR_CLIENT_SECRET: inventory-app-secret-2026
+      PROCUREMENT_CASDOOR_ORGANIZATION: inventory
+      PROCUREMENT_CASDOOR_APP_NAME: inventory-app
+      PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client
 
     ports:
       - "8000:8000"
@@ -130,6 +141,9 @@ services:
   frontend:
     build:
       context: ./frontend
+      args:
+        # Developer Mode panel on the login page — set false for production.
+        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-true}
     container_name: procurement-frontend
 
     ports: