refactor(dev): remove the dev-sandbox bootstrap everywhere

Stage 1 of the dev-as-prod-mirror rework. The auto-provisioned "Dev
Sandbox" game and dummy users are removed so the dev contour starts
empty like prod; the separate legacy-report loader stays as the
test-data path.

- delete backend/internal/devsandbox (package + tests)
- drop the bootstrap call + DevSandboxConfig (struct, Config field,
  BACKEND_DEV_SANDBOX_* env, defaults, loader, validation)
- strip BACKEND_DEV_SANDBOX_* from dev-deploy + local-dev compose and
  .env.example; the generic engine-recycle / prune-broken-engines logic
  stays (it serves real games)
- update tooling docs (dev-deploy README + KNOWN-ISSUES, local-dev
  README + Makefile) and stale comments; DeleteGame and
  InsertMembershipDirect remain (exercised by lobby integration tests)

No app behaviour change beyond not auto-creating the sandbox game.

tools/local-dev/Makefile

@@ -22,7 +22,7 @@ help:
 	@echo "  make up             Build (if needed) and bring up the stack, wait until healthy"
 	@echo "  make down           Stop compose containers, leave engines + volumes intact"
 	@echo "  make rebuild        Force rebuild of backend / gateway images and bring up"
-	@echo "  make build-engine   Build the engine image $(ENGINE_IMAGE) used by the dev sandbox"
+	@echo "  make build-engine   Build the engine image $(ENGINE_IMAGE) used by running games"
 	@echo "  make stop-engines   Stop and remove only the per-game engine containers"
 	@echo "  make prune-broken-engines  Remove non-running engine containers Docker can't heal (run inside 'up')"
 	@echo "  make clean          Stop everything (incl. engines) and wipe volumes + game state"
@@ -37,8 +37,9 @@ help:
 	@echo "  pnpm -C ui/frontend dev"
 	@echo "and open http://localhost:5173 (UI) plus http://localhost:8025 (Mailpit)."
 	@echo ""
-	@echo "Default login for the auto-provisioned dev sandbox: dev@local.test"
-	@echo "(see BACKEND_DEV_SANDBOX_EMAIL in .env). Login code: 123456."
+	@echo "Sign in with email-OTP; the fixed login code 123456 works when"
+	@echo "BACKEND_AUTH_DEV_FIXED_CODE is set in .env. No game is auto-provisioned —"
+	@echo "load a legacy report via the UI's DEV report loader to exercise the map."
 
 up: build-engine prune-broken-engines
 	$(COMPOSE) up -d --wait
@@ -88,12 +89,9 @@ stop-engines:
 # bind-mount source and leaves it stuck in `exited` / `created`
 # state. This target prunes the husks before `compose up`; the
 # backend's pre-bootstrap reconciler tick (`backend/cmd/backend/main.go`)
-# then cascades the orphan runtime row to `removed`, the lobby
-# cancels the game, and the dev-sandbox bootstrap purges the
-# cancelled tile and provisions a fresh sandbox in the same
-# `make up` cycle. Healthy `running` / `restarting` containers are
-# left intact so a long-lived sandbox survives normal up/down
-# cycles.
+# then cascades the orphan runtime row to `removed` and the lobby
+# cancels the game. Healthy `running` / `restarting` containers are
+# left intact so a long-lived game survives normal up/down cycles.
 prune-broken-engines:
 	@ids=""; \
 	for cid in $$(docker ps -aq \

tools/local-dev/README.md

@@ -78,49 +78,24 @@ To force the second path (no fast-bypass), edit
 `make rebuild` (or simply `docker compose up -d backend` to recreate
 the backend with the new env).
 
-## Auto-provisioned dev sandbox
+## No auto-provisioned game
 
-`make up` provisions a private game called **Dev Sandbox** owned by
-the dev user (default `dev@local.test`). The flow is implemented in
-`backend/internal/devsandbox` and runs on every backend boot when
-`BACKEND_DEV_SANDBOX_EMAIL` is non-empty in `tools/local-dev/.env`.
-
-Bootstrap is idempotent — re-running `make up` after a `make down`
-finds the existing user, dummy participants, game, and memberships
-without creating duplicates. If a previous boot crashed mid-way
-(game stuck in `enrollment_open` or `ready_to_start`), the next boot
-resumes the lifecycle.
-
-To log in straight into the sandbox:
+`make up` brings up the stack with an empty lobby — there is no
+auto-provisioned game. Sign in with email-OTP (the fixed dev code
+`123456` works when `BACKEND_AUTH_DEV_FIXED_CODE` is set in
+`tools/local-dev/.env`):
 
 1. `make -C tools/local-dev up`
 2. `pnpm -C ui/frontend dev` (in another terminal)
-3. Open <http://localhost:5173/login>, enter `dev@local.test`, then
-   the dev code `123456`.
-4. The lobby shows **Dev Sandbox** in *My Games*; click in.
+3. Open <http://localhost:5173/login>, enter your email, then the dev
+   code `123456`.
 
-To disable the bootstrap, clear `BACKEND_DEV_SANDBOX_EMAIL` in
-`tools/local-dev/.env` and `docker compose up -d backend` (or
-`make rebuild`). Existing users / games are not removed.
-
-Terminal sandbox games — anything in `cancelled`, `finished`, or
-`start_failed` — are deleted on every boot before find-or-create
-runs. The cascade declared in `00001_init.sql` removes the
-matching memberships, applications, invites, runtime records,
-and player mappings in the same write, so the dev user's lobby
-shows exactly one running tile at all times. Cancelling the
-sandbox manually and running `docker compose restart backend`
-(or `make rebuild`) yields a fresh game without leaving dead
-tiles behind.
-
-The bootstrap requires:
-- `galaxy-engine:local-dev` Docker image (`make build-engine`).
-- `BACKEND_DEV_SANDBOX_ENGINE_VERSION` parses as plain semver
-  (`MAJOR.MINOR.PATCH`); the default `0.1.0` is what the bootstrap
-  registers in the `engine_versions` row that points at the image.
-- `BACKEND_DEV_SANDBOX_PLAYER_COUNT` ≥ 20 (the engine's minimum;
-  19 deterministic dummies fill the slots so the single real user
-  can start the game).
+To exercise the map and report views without running a full game, use
+the UI's DEV **synthetic report loader**: convert a legacy `.REP` with
+`tools/local-dev/legacy-report/` and load the resulting JSON through the
+loader (see that tool's README). To play a real game, create one in the
+lobby and let the engine (`galaxy-engine:local-dev`, built by
+`make build-engine`) run it.
 - A frozen turn schedule (`0 0 1 1 *` — once a year) so the visible
   game state stays at turn 1 until you explicitly progress it.
 
@@ -239,24 +214,15 @@ make status         docker compose ps
   this in one cycle: `prune-broken-engines` (runs as part of `up`)
   removes every engine container that is not in `running` /
   `restarting` state, the backend's pre-bootstrap reconciler tick
-  cascades the orphan runtime row to `removed`, the lobby cancels
-  the matching sandbox game, and the dev-sandbox bootstrap purges
-  the cancelled tile and provisions a fresh sandbox with a brand
-  new state directory. To run the cleanup by hand without restarting
-  the rest of the stack, `make prune-broken-engines`.
+  cascades the orphan runtime row to `removed`, and the lobby cancels
+  the matching game. To run the cleanup by hand without restarting the
+  rest of the stack, `make prune-broken-engines`.
 
   The cycle relies on the backend image carrying the pre-bootstrap
   reconciler tick (`backend/cmd/backend/main.go`). `make up` reuses
   the cached image, so after pulling this commit the first time you
   must `make rebuild` once to bake the fix in. Future `make up`
   cycles will heal in one shot.
-
-  If after the heal cycle the lobby still shows only a `cancelled`
-  sandbox tile and no running game, the running backend image
-  predates the pre-bootstrap reconciler tick — the periodic ticker
-  cancels the orphan after bootstrap has already returned, leaving
-  the lobby in the half-baked state. `make rebuild` recreates the
-  image and then `make up` lands a fresh sandbox.
 - **`make up` reports a build error mentioning `pkg/cronutil`** —
   upstream module list drifted; copy any new `pkg/<name>/` line into
   the local-dev `backend.Dockerfile` / `gateway.Dockerfile` to match

tools/local-dev/docker-compose.yml

@@ -122,10 +122,6 @@ services:
       BACKEND_OTEL_TRACES_EXPORTER: none
       BACKEND_OTEL_METRICS_EXPORTER: none
       BACKEND_AUTH_DEV_FIXED_CODE: ${BACKEND_AUTH_DEV_FIXED_CODE:-}
-      BACKEND_DEV_SANDBOX_EMAIL: ${BACKEND_DEV_SANDBOX_EMAIL:-}
-      BACKEND_DEV_SANDBOX_ENGINE_IMAGE: ${BACKEND_DEV_SANDBOX_ENGINE_IMAGE:-}
-      BACKEND_DEV_SANDBOX_ENGINE_VERSION: ${BACKEND_DEV_SANDBOX_ENGINE_VERSION:-}
-      BACKEND_DEV_SANDBOX_PLAYER_COUNT: ${BACKEND_DEV_SANDBOX_PLAYER_COUNT:-}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       # Per-game state directories live under the same absolute path