feat(dev): add compose files and dev-login bypass route

- compose.prod.yml: production stack with registry image, healthcheck,
  migration service
- compose.test.yml: local test stack with source mount and LOCAL=true
- routes/dev-login.ts: fake admin JWT login, only active when LOCAL=true
- routes/_middleware.ts: expose /dev-login as public route

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routes/dev-login.ts

@@ -0,0 +1,48 @@
+import { FreshContext, Handlers } from "$fresh/server.ts";
+import { CasContent, LoginJWT, State } from "$root/defaults/interfaces.ts";
+import { createJwt } from "@popov/jwt";
+import { setCookie } from "$std/http/cookie.ts";
+import { getKey } from "$root/routes/_middleware.ts";
+
+const FAKE_ADMIN: CasContent = {
+  amuCampus: "local",
+  amuComposante: "local",
+  amuDateValidation: "",
+  coGroup: "",
+  eduPersonPrimaryAffiliation: "employee",
+  eduPersonPrincipalName: "admin@local",
+  mail: "admin@local",
+  displayName: "Admin Local",
+  givenName: "Admin",
+  memberOf: [],
+  sn: "Local",
+  supannCivilite: "",
+  supannEntiteAffectation: "",
+  supannEtuAnneeInscription: "",
+  supannEtuEtape: "",
+  uid: "admin-local",
+};
+
+export const handler: Handlers<null, State> = {
+  async GET(_request: Request, _context: FreshContext<State, null>) {
+    if (Deno.env.get("LOCAL") !== "true") {
+      return new Response("Not available outside LOCAL mode.", { status: 403 });
+    }
+
+    const now = Math.floor(Date.now() / 1000);
+    const payload: LoginJWT = {
+      iss: "PolyMPR",
+      iat: now,
+      exp: now + 0xe10,
+      aud: "PolyMPR",
+      user: FAKE_ADMIN,
+    };
+
+    const token = await createJwt(payload, getKey(FAKE_ADMIN.uid));
+    const headers = new Headers();
+    setCookie(headers, { name: "sessionToken", value: token });
+    headers.set("Location", "/apps");
+
+    return new Response(null, { status: 302, headers });
+  },
+};