feat(websim): browser A320 cockpit to test /live-atc without MSFS (WIP)

Flight model (ground/air physics, SELECTED/NAV/APPR/AUTOLAND autopilot with
STAR sequencing and ILS capture), bridge client that feeds the existing
/api/bridge/* endpoints so /live-atc can't tell it apart from a real bridge,
and the cockpit UI (PFD reuse, FCU, radio panel, Leaflet ND, three.js
exterior, spawn presets at EDDF/EDDS). Design doc:
docs/plans/2026-07-16-websim-design.md.

Also adds a local-dev-only auto-login (/dev-login, server/api/dev/login.post.ts)
that bypasses the invite-only login and MongoDB entirely via a fixed in-memory
user, so require-auth pages are reachable for local testing even when the dev
DB is unreachable. Hard-disabled outside development.

Status: unit tests green (yarn test) and typecheck clean (yarn typecheck).
Browser walkthrough of the actual cockpit (flying a preset, confirming
telemetry reaches /live-atc) is not yet done — picking up from a fresh dev
server + /dev-login?redirect=/flightlab/websim confirmed the spawn screen
renders past auth, but full instrument/map/exterior verification is still
outstanding.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/api/dev/login.post.ts

@@ -0,0 +1,36 @@
+import { createError } from 'h3'
+import { getDevBypassUser, issueAuthTokens } from '../../utils/auth'
+
+/**
+ * Local-dev-only auto-login: issues real session tokens for a fixed,
+ * entirely in-memory test user — no database involved — so an agent (or a
+ * developer) can reach any require-auth-gated page on localhost without an
+ * invitation code, even when the dev database itself is unreachable.
+ *
+ * Hard-disabled outside development. This must never be reachable from a
+ * deployed environment — the NODE_ENV check below is the entire security
+ * boundary and must not be relaxed or made configurable. Excluded from the
+ * global requireUserSession gate in server/middleware/auth.global.ts (same
+ * as /api/service/*, /api/bridge/*, /api/copilot/*) since it must be
+ * reachable while logged out.
+ */
+export default defineEventHandler(async (event) => {
+  if (process.env.NODE_ENV === 'production') {
+    throw createError({ statusCode: 404, statusMessage: 'Not found' })
+  }
+
+  const user = getDevBypassUser()
+  const tokens = await issueAuthTokens(event, user)
+
+  return {
+    success: true,
+    accessToken: tokens.accessToken,
+    user: {
+      id: String(user._id),
+      email: user.email,
+      name: user.name,
+      role: user.role,
+      createdAt: user.createdAt,
+    },
+  }
+})