refactor(dev): remove the dev-sandbox bootstrap everywhere

Stage 1 of the dev-as-prod-mirror rework. The auto-provisioned "Dev
Sandbox" game and dummy users are removed so the dev contour starts
empty like prod; the separate legacy-report loader stays as the
test-data path.

- delete backend/internal/devsandbox (package + tests)
- drop the bootstrap call + DevSandboxConfig (struct, Config field,
  BACKEND_DEV_SANDBOX_* env, defaults, loader, validation)
- strip BACKEND_DEV_SANDBOX_* from dev-deploy + local-dev compose and
  .env.example; the generic engine-recycle / prune-broken-engines logic
  stays (it serves real games)
- update tooling docs (dev-deploy README + KNOWN-ISSUES, local-dev
  README + Makefile) and stale comments; DeleteGame and
  InsertMembershipDirect remain (exercised by lobby integration tests)

No app behaviour change beyond not auto-creating the sandbox game.

tools/dev-deploy/README.md

@@ -114,8 +114,7 @@ calls `make clean-data`.
 The same dev-mode email-code override as `tools/local-dev/` applies,
 and the dev-deploy compose ships with it enabled by default:
 
-1. Enter `dev@galaxy.lan` (or whatever `BACKEND_DEV_SANDBOX_EMAIL`
-   resolves to) in the login form.
+1. Enter your email address in the login form.
 2. Submit `123456` as the code — the docker-compose default for
    `BACKEND_AUTH_DEV_FIXED_CODE` is `123456`, so the bcrypt-hashed
    email code stays a fallback. To force real Mailpit codes (e.g. for
@@ -212,8 +211,7 @@ make clean-data     Stop everything and wipe volumes + game-state dir
 ## Known issues
 
 See [`KNOWN-ISSUES.md`](KNOWN-ISSUES.md) for symptoms that surface
-in the long-lived dev environment but are not yet fixed (currently:
-the sandbox game flipping to `cancelled` after a redispatch).
+in the long-lived dev environment but are not yet fixed.
 
 ## Deployment cadence
 
@@ -237,12 +235,12 @@ behind. There is no separate state to clean up between the two paths.
 
 ### Engine image drift recycle
 
-`backend` spawns one engine container per game (the long-lived "Dev
-Sandbox" plus any user-created games) and the reconciler reattaches
-to whatever it finds with the `galaxy.stack=dev-deploy` label. That
-reattach does not check the running container's image SHA against the
-freshly-built `galaxy-engine:dev` tag, so an unchanged container would
-otherwise keep serving the previous engine code after a redeploy.
+`backend` spawns one engine container per running game and the
+reconciler reattaches to whatever it finds with the
+`galaxy.stack=dev-deploy` label. That reattach does not check the
+running container's image SHA against the freshly-built
+`galaxy-engine:dev` tag, so an unchanged container would otherwise
+keep serving the previous engine code after a redeploy.
 
 The `dev-deploy.yaml` workflow handles this in the
 `Recycle engine containers on image drift` step. When `docker build`
@@ -250,9 +248,7 @@ produces a new `galaxy-engine:dev` SHA, the step compares it against
 every running `galaxy-game-*` container and, for each drifted one,
 stops the backend, removes the container, wipes its bind-mounted
 state directory (Engine.Init() writes turn-0 over any pre-existing
-`turn-N` files), and cascade-deletes the lobby `games` row. The
-`dev-sandbox` bootstrap on the next backend boot finds no live
-sandbox and provisions a fresh one on the new engine image.
+`turn-N` files), and cascade-deletes the lobby `games` row.
 
 When the engine sources are unchanged, the BuildKit cache hits and
 the SHA stays the same — the recycle step is a no-op and the running