MC 900254 — Stage dev-login ekran (2026-08-26)

MC #900254 — Stage dev-login ekran (2026-08-26)

Task: [Bilko][H][STAGE] Dev-login forma (email+secret) preko postojećeg test/session endpointa — CEO nalog 26.08. ~00:45 (brana preskočena CEO riječju).

Zašto

CEO testira stage bez CIAM-a; konzolni snippet (verifikovan Playwrightom, radi) je preklimav za ljudsku upotrebu.

Dizajn (John, pinovan)

• apps/web/app/(auth)/dev-login/page.tsx — server komponenta, export const dynamic = 'force-dynamic', gate: process.env.ENABLE_DEV_LOGIN === '1' inače notFound(). NE NEXT_PUBLIC_ (build-time inline bi procurio u demo/prod — ista slika se promotuje).
• Klijent forma (zaseban fajl, ne export iz page): email (default [email protected]) + secret → POST {NEXT_PUBLIC_API_URL}/api/v1/auth/test/session {testSecret, testEmail} → sessionStorage.setItem('bilko_access_token', tokens.accessToken) + document.cookie='bilko_refresh_token='+tokens.refreshToken+'; path=/; secure; samesite=lax' → location.href='/dashboard'. (Edge middleware provjerava samo postojanje cookieja — middleware.ts:43-50.)
• /dev-login dodati u PUBLIC paths listu middleware.ts (~:19) — inače edge vrati na /login.
• Dvostruka brava: prod API nema secret (endpoint 404), demo web nema ENABLE_DEV_LOGIN (stranica 404).
• Poslije mergea: John setuje ENABLE_DEV_LOGIN=1 samo na bilko-web-stage.