Add device-grant dev sign-in (CRD-driven) for local/agent development

AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel
server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite
dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

k8s/deployment.yaml

@@ -51,6 +51,10 @@ spec:
           value: "https://users.k6n.net"
         - name: OTEL_OIDC_CLIENT_ID
           value: "otel-debug"
+        # Also accept tokens whose aud carries this service's URL (device-grant
+        # dev tokens from the dev-console client, see k8s/auth-dev.yaml).
+        - name: OTEL_OIDC_AUDIENCE
+          value: "https://otel.k6n.net"
         # Service credential for non-interactive debugging agents. It grants
         # access to protected /api debug endpoints, not OTLP ingest.
         - name: OTEL_AGENT_TOKEN