fix: bypass auth in dev mode and add mock session for development

next build bakes NODE_ENV=production into the bundle, so a custom
DEV_MODE env var is used instead. Middleware bypasses auth by hostname
for the dev domain, and getQuestSession returns a mock admin session
when DEV_MODE=true. Login page now uses window.location.href for
full-page navigation to ensure the session cookie is sent.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -72,6 +72,7 @@ services:
       - web
     environment:
       NODE_ENV: development
+      DEV_MODE: "true"
       DATABASE_URL: postgresql://postgres:L9IbAPm7zFFaTdfCgVxDQhK7cKp8%2BwGH1pNp%2Fsz0joA%3D@postgres:5432/vorteq_dev
       REDIS_URL: redis://redis:6379/0
       BETTER_AUTH_SECRET: ${DEV_AUTH_SECRET}