dev-deploy: enable Dev Sandbox bootstrap and synthetic-report loader

Two long-standing dev-environment ergonomics had not survived the
move from the bespoke local-dev stack to the CI-driven dev-deploy:

1. `BACKEND_DEV_SANDBOX_EMAIL` defaulted to an empty string in the
   dev-deploy compose, so the auto-provisioned "Dev Sandbox" game
   never appeared on `https://www.galaxy.lan`. Bake `dev@galaxy.lan`
   as the default — matches `.env.example` and lets a developer who
   logs in with that email find a ready-to-play game in the lobby.

2. The lobby's synthetic-report loader was gated on
   `import.meta.env.DEV`, which is true only for `vite dev` (the
   tools/local-dev path). The long-lived dev environment builds
   with `vite build` (production mode), so the section was always
   stripped from its bundle. Gate it on an explicit
   `VITE_GALAXY_DEV_AFFORDANCES` flag instead and set it both in
   `.env.development` (preserves `pnpm dev` behaviour) and in the
   `dev-deploy.yaml` build step. The `prod-build.yaml` build path
   leaves the flag unset, so production stays clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/dev-deploy.yaml

@@ -69,6 +69,11 @@ jobs:
         working-directory: ui/frontend
         env:
           VITE_GATEWAY_BASE_URL: https://api.galaxy.lan
+          # Surface the synthetic-report loader and similar dev-only
+          # affordances in the long-lived dev bundle. The prod build
+          # path (`prod-build.yaml`) leaves this flag unset so the
+          # production bundle keeps the same affordances stripped.
+          VITE_GALAXY_DEV_AFFORDANCES: "true"
         run: |
           # The response-signing public key is committed in
           # `.env.development` alongside its private counterpart in

tools/dev-deploy/Makefile

@@ -62,6 +62,7 @@ seed-ui:
 	@echo "building UI (vite build)…"
 	(cd $(REPO_ROOT)/ui/frontend && \
 	  VITE_GATEWAY_BASE_URL=https://api.galaxy.lan \
+	  VITE_GALAXY_DEV_AFFORDANCES=true \
 	  VITE_GATEWAY_RESPONSE_PUBLIC_KEY=$$(cat $(REPO_ROOT)/ui/frontend/.env.development \
 	      | sed -n 's/^VITE_GATEWAY_RESPONSE_PUBLIC_KEY=//p') \
 	  pnpm build)

tools/dev-deploy/docker-compose.yml

@@ -107,7 +107,12 @@ services:
       # bcrypt-hashed code is single-use). Set the var to an empty
       # string in `.env` to disable.
       BACKEND_AUTH_DEV_FIXED_CODE: ${BACKEND_AUTH_DEV_FIXED_CODE:-123456}
-      BACKEND_DEV_SANDBOX_EMAIL: ${BACKEND_DEV_SANDBOX_EMAIL:-}
+      # Long-lived dev environment always bootstraps the "Dev Sandbox"
+      # game owned by this email so a freshly redeployed stack already
+      # has one ready-to-play game in the lobby. Set the variable to an
+      # empty string in `.env` to disable the bootstrap (e.g. for a
+      # cold-start QA pass).
+      BACKEND_DEV_SANDBOX_EMAIL: ${BACKEND_DEV_SANDBOX_EMAIL:-dev@galaxy.lan}
       BACKEND_DEV_SANDBOX_ENGINE_IMAGE: ${BACKEND_DEV_SANDBOX_ENGINE_IMAGE:-galaxy-engine:dev}
       BACKEND_DEV_SANDBOX_ENGINE_VERSION: ${BACKEND_DEV_SANDBOX_ENGINE_VERSION:-0.1.0}
       BACKEND_DEV_SANDBOX_PLAYER_COUNT: ${BACKEND_DEV_SANDBOX_PLAYER_COUNT:-20}

ui/frontend/.env.development

@@ -16,3 +16,9 @@ VITE_GATEWAY_BASE_URL=http://localhost:5173
 # key. Pairs with `tools/local-dev/keys/gateway-response.pem`. The pair
 # is dev-only — see `tools/local-dev/keys/README.md` before rotating.
 VITE_GATEWAY_RESPONSE_PUBLIC_KEY=nIG54tCuNiIKrazt8Hh7YxmmU/BhpseGhIIgj164Chw=
+
+# Opt in to dev-time UI affordances that should never reach a
+# production bundle — currently the synthetic-report loader in the
+# lobby. Mirror this flag in any long-lived dev build (e.g.
+# `dev-deploy.yaml`); the prod build path leaves it unset.
+VITE_GALAXY_DEV_AFFORDANCES=true

ui/frontend/src/routes/lobby/+page.svelte

@@ -375,13 +375,18 @@
 		{/if}
 	</section>
 
-	{#if import.meta.env.DEV}
+	{#if import.meta.env.VITE_GALAXY_DEV_AFFORDANCES === "true"}
 		<!--
-		Synthetic-report loader. DEV-only affordance for visual testing
+		Synthetic-report loader. Dev-only affordance for visual testing
 		against rich game states without playing many turns. The JSON
 		is produced offline by the Go CLI in
 		`tools/local-dev/legacy-report/`; see
-		`ui/docs/testing.md#synthetic-reports` for the workflow.
+		`ui/docs/testing.md#synthetic-reports` for the workflow. Gated
+		on `VITE_GALAXY_DEV_AFFORDANCES` (set in `.env.development` and
+		mirrored by `dev-deploy.yaml`) rather than `import.meta.env.DEV`
+		so the long-lived dev environment can also surface it from a
+		production-mode bundle. The prod build path leaves the flag
+		unset, so the section is stripped from prod chunks.
 		-->
 		<section data-testid="lobby-synthetic-section">
 			<h2>Synthetic test reports (DEV)</h2>