Add device-grant dev sign-in (CRD-driven) for local/agent development

AuthClient dev-console + AuthServer deviceFlow via k8s/auth-dev.yaml; otel
server accepts its own URL as an extra audience (OTEL_OIDC_AUDIENCE). Vite
dev-only device-flow sign-in, scripts/dev-auth.mjs helper, AGENTS.md notes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

otel-ui/vite.config.ts

@@ -3,6 +3,9 @@ import react from "@vitejs/plugin-react";
 import tailwindcss from "@tailwindcss/vite";
 
 const target = "https://otel.k6n.net";
+// Device-grant issuer for local/agent development (see src/dev/device-auth.ts).
+// Proxied same-origin so the browser needs no CORS and no issuer URL.
+const authIssuer = process.env.AUTH_DEV_BASE ?? "https://users.k6n.net";
 
 // https://vite.dev/config/
 export default defineConfig({
@@ -18,6 +21,11 @@ export default defineConfig({
         target: target,
         changeOrigin: true,
       },
+      "/dev-auth": {
+        target: authIssuer,
+        changeOrigin: true,
+        rewrite: (path) => path.replace(/^\/dev-auth/, "/api/auth"),
+      },
       "/auth_callback": {
         target: target,
         changeOrigin: true,