chore(dev): add stub OAuth IdP + seed + bridge smoketest for native SSO

Dev environments have no real OAuth provider configured, so GET /auth/providers
returns [] and the native mobile SSO flow cannot be exercised locally. Add
dependency-free dev tooling under scripts/dev/:

- stub-idp.js: stub OAuth2/OIDC IdP (authorize picker, token, userinfo)
- seed-sso-provider.js: registers a 'devstub' auth_providers row + pre-links
  each principal's sub to a dev account (SSO is link-only)
- sso-bridge-smoketest.js: drives the full app flow headless (PKCE → start →
  IdP → callback → deep link → exchange) and asserts a bearer pair
- README.md: host + emulator usage

Verified end-to-end against the local site: player and admin principals both
sign in and receive the correct role. DEV ONLY — never deploy the stub.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/dev/README.md

@@ -0,0 +1,58 @@
+# Dev SSO tooling
+
+Local-only helpers for exercising the native **mobile SSO bridge** without a real
+OAuth provider. Dev environments have no IdP configured, so `GET /auth/providers`
+returns `[]`, the app renders no SSO buttons, and the flow can't be tested. These
+scripts stand up a stub IdP, register it, and verify the full bridge headlessly.
+
+> **DEV ONLY.** `stub-idp.js` performs no credential checks and will sign in anyone.
+> Never run it against a shared/production database or expose it publicly.
+
+## Files
+
+| File | Role |
+|---|---|
+| `stub-idp.js` | Dependency-free stub OAuth2/OIDC IdP: `GET /authorize` (account picker), `POST /token`, `GET /userinfo`. |
+| `seed-sso-provider.js` | Registers an `auth_providers` row (`devstub`) pointing at the stub and pre-links each principal's `sub` to a dev account (SSO is link-only). Reads DB creds from `server/.env`. |
+| `sso-bridge-smoketest.js` | Drives the whole app flow headless: PKCE → `/auth/mobile/sso/start` → stub → website callback → `runicgateway://auth/callback` deep link → `/auth/mobile/sso/exchange`. |
+
+## Usage (host / headless)
+
+```bash
+# 1. seed the provider + linked identities (one-time; idempotent)
+node scripts/dev/seed-sso-provider.js
+
+# 2. run the stub IdP (leave running)
+node scripts/dev/stub-idp.js
+
+# 3. run the website with the callback origin pointed at the API port, so the
+#    whole flow is same-origin (dev default APP_BASE_URL is the Vite client :5173)
+cd server && APP_BASE_URL=http://127.0.0.1:3000 npm start
+
+# 4. verify the bridge (from the website root)
+node scripts/dev/sso-bridge-smoketest.js stub-colby   # or stub-admin
+```
+
+A pass prints the resolved user, an access token, and a present refresh token.
+
+## Usage (Android emulator)
+
+The **authorize** URL is followed by the device browser (Custom Tab); **token** and
+**userinfo** are called server-side by the website. On an emulator the host is
+`10.0.2.2`, so seed with split URLs:
+
+```bash
+STUB_IDP_PUBLIC_URL=http://10.0.2.2:9099 \
+STUB_IDP_INTERNAL_URL=http://127.0.0.1:9099 \
+  node scripts/dev/seed-sso-provider.js
+```
+
+Point the app's server at `http://10.0.2.2:3000`, and run the website with
+`APP_BASE_URL=http://10.0.2.2:3000` so the IdP callback returns to a device-reachable
+origin.
+
+## Principals
+
+`stub-admin` → dev user `admin` (role admin) · `stub-colby` → dev user `colby`
+(role player). Keep the `sub` list in sync between `stub-idp.js` and
+`seed-sso-provider.js`.