chore(deps)(deps): bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.4 in /gearbox in the go-dependencies group - #1

- Lint: golangci-lint's `unused` check runs without the `dev` build tag,
  so the shared constants in dev_bypass.go were flagged. Delete the
  shared file and inline the two constants into dev_bypass_on.go where
  they are actually referenced.

- Doc accuracy (Copilot #1, #2): the `-tags dev` flag is set by the
  `dev:` target in gearbox/Makefile via `air --build.cmd "$(DEV_BUILD_CMD)"`,
  not by `.air.toml` (which is gitignored per-developer). Update the
  package doc and four function/header comments in dev_bypass_on.go,
  and the corresponding section in gearbox/docs/development.md, to
  reference the Makefile and drop the broken `../.air.toml` link.

- Security (Copilot #3): EnsureDevUserExists previously returned early
  if a `dev` row already existed, leaving its password_hash untouched.
  A developer who manually set a password on that row could then form-
  login as a `dev` admin, contradicting the "form-login can never
  authenticate as this user" claim. Always rewrite password_hash to
  the caller-supplied dummyPasswordHash, plus reset status and
  must_change_password back to the safe defaults, on every call.
  Other fields (role, names) are still preserved across runs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(#83): dev-only loopback auto-login bypass

Compiled in only when the binary is built with `-tags dev` (which the
`make dev` target now passes via air's --build.cmd). When all three of
these hold the request is auto-authenticated as the seeded `dev` user:

  1. Build tag `dev` is set.
  2. GEARBOX_DEV_AUTO_LOGIN=1 in the environment.
  3. Post-RealIP RemoteAddr is a loopback IP.

Production builds (`make build`) replace every entry point with a
no-op stub via dev_bypass_off.go, so the bypass code, env-var check,
loopback check, seed function, and banner are not present in release
binaries at all.

Verified:
  - dev binary contains GEARBOX_DEV_AUTO_LOGIN and seed/banner strings;
    prod binary contains only the tryDevBypass no-op stub symbol.
  - cookieless GET /  ->  303 /haproxy (auto-login).
  - cookieless GET / with X-Forwarded-For: 1.2.3.4  ->  303 /login
    (chi.RealIP rewrites RemoteAddr, loopback check declines).

The seeded `dev` user has the package-level dummyPasswordHash so the
form-login path can never authenticate as it; only the loopback bypass
can. The seed is itself build-tag-gated (users_dev.go) so prod doesn't
even contain the seed function.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(#83): address Copilot review on #84

- Lint: golangci-lint's `unused` check runs without the `dev` build tag,
  so the shared constants in dev_bypass.go were flagged. Delete the
  shared file and inline the two constants into dev_bypass_on.go where
  they are actually referenced.

- Doc accuracy (Copilot #1, #2): the `-tags dev` flag is set by the
  `dev:` target in gearbox/Makefile via `air --build.cmd "$(DEV_BUILD_CMD)"`,
  not by `.air.toml` (which is gitignored per-developer). Update the
  package doc and four function/header comments in dev_bypass_on.go,
  and the corresponding section in gearbox/docs/development.md, to
  reference the Makefile and drop the broken `../.air.toml` link.

- Security (Copilot #3): EnsureDevUserExists previously returned early
  if a `dev` row already existed, leaving its password_hash untouched.
  A developer who manually set a password on that row could then form-
  login as a `dev` admin, contradicting the "form-login can never
  authenticate as this user" claim. Always rewrite password_hash to
  the caller-supplied dummyPasswordHash, plus reset status and
  must_change_password back to the safe defaults, on every call.
  Other fields (role, names) are still preserved across runs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>