refactor(dev): remove the dev-sandbox bootstrap everywhere

Stage 1 of the dev-as-prod-mirror rework. The auto-provisioned "Dev
Sandbox" game and dummy users are removed so the dev contour starts
empty like prod; the separate legacy-report loader stays as the
test-data path.

- delete backend/internal/devsandbox (package + tests)
- drop the bootstrap call + DevSandboxConfig (struct, Config field,
  BACKEND_DEV_SANDBOX_* env, defaults, loader, validation)
- strip BACKEND_DEV_SANDBOX_* from dev-deploy + local-dev compose and
  .env.example; the generic engine-recycle / prune-broken-engines logic
  stays (it serves real games)
- update tooling docs (dev-deploy README + KNOWN-ISSUES, local-dev
  README + Makefile) and stale comments; DeleteGame and
  InsertMembershipDirect remain (exercised by lobby integration tests)

No app behaviour change beyond not auto-creating the sandbox game.

ui/docs/game-state.md

@@ -85,16 +85,16 @@ report to fetch. Two alternatives were rejected:
 - a brand-new `user.games.state` message — adds a full wire-flow
   (fbs schema, transcoder, gateway routing, backend handler) for a
   one-field response;
-- hard-coding `turn=0` for all games — works for the dev sandbox
-  (which never advances past turn zero) but renders the initial
-  state for any real game past turn zero.
+- hard-coding `turn=0` for all games — works for a synthetic report
+  loaded at turn zero but mis-renders the initial state for any real
+  game past turn zero.
 
 Extending `GameSummary` reuses the existing lobby pipeline; the
 backend already tracks `current_turn` in its runtime projection
 (`backend/internal/server/handlers_user_lobby_helpers.go`
 `gameSummaryToWire` reads it from `g.RuntimeSnapshot.CurrentTurn`).
 The `current_turn` field defaults to zero on the FB side, so existing
-tests and the dev sandbox flow continue to work unchanged.
+tests and the synthetic-report flow continue to work unchanged.
 
 ## State binding