[Fix] Dev login requires an explicit opt-in and sandbox previews regain a development app env

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @openmote, in the web UI, or in Slack.

What changed

/auth/dev-login — the unauthenticated local-admin backdoor — now requires an explicit WEB_DEV_LOGIN_ENABLED=true (or 1) opt-in on top of its existing guards (NODE_ENV !== 'production', development app env, loopback-only bind). Without the flag the route returns 404 even in a development app env.

The intended dev flows keep working without manual steps:

• pnpm dev (ecosystem.config.js) sets the flag for the local web app, with an operator override.
• The in-repo Roomote sandbox environment definition (.roomote/environments/roomote.yaml) sets the flag on the web dev server and in .env.local, and now also guards the sandbox shell's R_APP_ENV export so the inline R_APP_ENV=development on the dev-server commands is not clobbered by the R_APP_ENV=production that hosting deployments forward into sandboxes.

The new env var is documented in apps/docs/environment-variables.mdx.

Why this change was made

The R_* env rename (#78) made resolveAppEnv() read only R_APP_ENV, and the platform forwards its own APP_ENV=production into every sandbox as R_APP_ENV=production. Roomote-dev sandboxes therefore resolved a production app env, dev login 404'd, and delegated proof capture could no longer authenticate in live previews. Beyond restoring that flow, the app env alone is a weak gate for an admin backdoor: resolveAppEnv() falls back to development when unset, so a deployment that never configures R_APP_ENV would implicitly qualify. The explicit opt-in makes exposure a deliberate choice.

How it was tested

• New parameterized route tests assert /auth/dev-login 404s when WEB_DEV_LOGIN_ENABLED is unset, empty, false, or 0; existing tests cover the enabled path (14/14 passing).
• pnpm lint, pnpm check-types, pnpm --filter @roomote/docs check, and the declarative-environment schema test all pass.
• Verified live in a Roomote sandbox: with a development app env the route 404s until the flag is set, then signs in and lands on the dashboard (screenshots below).

Impact

Deployments that implicitly resolve a development app env no longer expose the dev-login backdoor. Local pnpm dev and the dogfood sandbox environment are unaffected. Roomote sandboxes provisioned from the in-repo environment definition regain working dev login (and therefore working visual-proof capture) even when the hosting platform forwards a production R_APP_ENV. Operator-managed environment definitions that start the web app directly must set WEB_DEV_LOGIN_ENABLED=true to keep using dev login.

Screenshots

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-roomote]

No code issues found. See task

Reviewed the explicit WEB_DEV_LOGIN_ENABLED opt-in gate on /auth/dev-login, the shared isEnvFlagEnabled wiring, the env schema addition, the pnpm dev / sandbox environment defaults, the R_APP_ENV clobber guard, docs, and the new parameterized route tests. The gate is placed correctly (flag check short-circuits ahead of the existing app-env and loopback guards), the tests cover the unset/empty/false/0 disabled cases, and the sandbox/ecosystem.config.js defaults keep the intended dev flows working with an operator override. No blocking or actionable issues.