Add device-grant dev sign-in (CRD-driven) for local/agent development

AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel
server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite
dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

AGENTS.md

@@ -171,3 +171,24 @@ Initial pass is done. Take **one view at a time** to the full screen pattern
 (FilterBar + card/aside layout, real buttons, fold or restyle the shared
 chrome for that screen), verify it in the browser in both themes, commit, then
 move to the next. Suggested order: Traces, Logs, Metrics, Search, Trends, Setup.
+
+## Local / agent development without login blocking
+
+Uses the go-auth device grant (RFC 8628); reference: `https://users.k6n.net/dev-auth.md`.
+Config is CRD-driven (`https://users.k6n.net/crds.md`), see `k8s/auth-dev.yaml`:
+an `AuthClient` `dev-console` with `spec.audience: [https://otel.k6n.net]`
+(audience entries must be absolute URLs - `otel-debug` was rejected and briefly
+made the AuthServer `READY False`), plus `AuthServer.spec.deviceFlow`. The otel
+server accepts that audience via `OTEL_OIDC_AUDIENCE` (`k8s/deployment.yaml`).
+
+- **Browser (`npm run dev`)**: `src/dev/device-auth.ts` is imported only under
+  `import.meta.env.DEV`. With no session it shows a "Dev sign-in" link + code,
+  polls, then reloads. `/dev-auth/*` is proxied by `vite.config.ts` to the
+  issuer's `/api/auth/*` (override the issuer with `AUTH_DEV_BASE`).
+- **Terminal / agents**: `node scripts/dev-auth.mjs login|token|whoami|forget`.
+  Refresh token lives in `~/.go-auth/dev/` (0700/0600). Use
+  `curl -H "Authorization: Bearer $(node scripts/dev-auth.mjs token)" ...`.
+  `GO_AUTH_TOKEN` is an explicit-token escape hatch; never store it.
+- Never commit tokens, never persist them in a production build, never log them.
+- Apply with `kubectl apply --dry-run=server --server-side --field-manager=otel-dev-auth -f k8s/auth-dev.yaml`
+  first; check `kubectl get authserver -n ecommerce` stays `READY True`.