Add device-grant dev sign-in (CRD-driven) for local/agent development

AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel
server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite
dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

k8s/auth-dev.yaml

@@ -0,0 +1,35 @@
+# Local/agent development sign-in via the RFC 8628 device grant.
+# Tokens minted for dev-console carry aud=[dev-console, https://otel.k6n.net], so the
+# otel server (which requires aud to contain its own URL (OTEL_OIDC_AUDIENCE)) accepts them with no
+# server-side change. Approval is still gated by the issuer's normal policy.
+apiVersion: auth.k6n.net/v1alpha1
+kind: AuthClient
+metadata:
+  name: dev-console
+  namespace: ecommerce
+  labels:
+    auth.k6n.net/server: auth
+spec:
+  clientID: dev-console
+  displayName: Dev console (device grant)
+  description: Public dev client for local and agent development via the device grant
+  redirectURIs: []
+  audience:
+    - https://otel.k6n.net
+  scopes:
+    - openid
+    - profile
+    - email
+    - offline_access
+---
+# Partial apply: only deviceFlow is owned by this field manager.
+apiVersion: auth.k6n.net/v1alpha1
+kind: AuthServer
+metadata:
+  name: auth
+  namespace: ecommerce
+spec:
+  deviceFlow:
+    clientID: dev-console
+    codeTTL: 10m
+    pollInterval: 5s