Add AUTH_DEV_AUTOLOGIN to switch off the login on development instances

With AUTH_DEV_AUTOLOGIN=<username>, every /api request without a valid
session runs as that existing, active user and skips the forced password
change. Unset keeps the normal login; unknown or deactivated users still
get 401, real sessions take precedence, the CSRF application header stays
mandatory and the API logs a warning at startup. The switch is not
limited to localhost because the development instance is reached from
other machines and through a reverse proxy (THREATMODEL D2/R15). It must
never be set on an instance with real project data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

compose.dev.yaml

@@ -39,6 +39,9 @@ services:
       AUTH_BOOTSTRAP_PASSWORT: "${AUTH_BOOTSTRAP_PASSWORT:-}"
       AUTH_SESSION_HOURS: "${AUTH_SESSION_HOURS:-12}"
       AUTH_SESSION_MAX_DAYS: "${AUTH_SESSION_MAX_DAYS:-7}"
+      # Nur Entwicklungsinstanzen: Benutzername, mit dem jede Anfrage ohne
+      # Session automatisch angemeldet ist (Login aus). Leer = Login aktiv.
+      AUTH_DEV_AUTOLOGIN: "${AUTH_DEV_AUTOLOGIN:-}"
       COOKIE_SECURE: "${COOKIE_SECURE:-false}"
     # Nur auf dem Loopback: die API darf nicht aus dem LAN erreichbar sein.
     ports: