fix(auth): gate dev-login from production registration

[Ridanshi]

Closes #298

Summary

Adds focused regression coverage for /auth/dev-login production gating.

The underlying route guard already exists on latest upstream/main:

if (process.env.NODE_ENV !== 'production') {
  app.post('/dev-login', ...)
}