local-dev: boot-time dev sandbox provisions a runnable game on up

Adds backend/internal/devsandbox: an idempotent boot-time hook that,
when BACKEND_DEV_SANDBOX_EMAIL is set, ensures (1) the configured
engine_version row, (2) the real dev user, (3) PlayerCount-1
deterministic dummy users, (4) a private "Dev Sandbox" game with a
year-out turn schedule, (5) memberships for every participant via
the new lobby.Service.InsertMembershipDirect helper, (6) a drive of
the lifecycle to running. Re-running on a populated DB is a no-op;
partial states from earlier crashes are recovered.

tools/local-dev gains the matching env vars in .env, surfaces them
in compose, and acquires a `make build-engine` target that builds
galaxy-engine:local-dev from game/Dockerfile (a prerequisite of
`up`/`rebuild`). The compose game-state mount is changed from a
named volume to a host bind on /tmp/galaxy-game-state so backend's
bind-mount source for spawned engine containers resolves on the
docker daemon.

After `make -C tools/local-dev up`, login as dev@local.test with
the dev code 123456 and the Dev Sandbox already shows up in My
Games. Per-user behaviour for the same email survives a backend
restart.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/internal/devsandbox/bootstrap_test.go

@@ -0,0 +1,86 @@
+package devsandbox
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"galaxy/backend/internal/config"
+
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+// TestBootstrapSkippedWhenEmailEmpty exercises the no-op branch: with
+// the production posture (Email == "") Bootstrap must return without
+// touching any dependency. The fact that Users/Lobby/EngineVersions
+// are nil here doubles as a check that the early-return runs first.
+func TestBootstrapSkippedWhenEmailEmpty(t *testing.T) {
+	err := Bootstrap(
+		context.Background(),
+		Deps{},
+		config.DevSandboxConfig{},
+		zap.NewNop(),
+	)
+	if err != nil {
+		t.Fatalf("expected nil error on empty email, got: %v", err)
+	}
+}
+
+// TestBootstrapRejectsZeroPlayerCount confirms the validation
+// short-circuits the flow before any DB call when PlayerCount is
+// non-positive but Email is set. The error path is fast and never
+// dereferences the (still-nil) Users/Lobby deps.
+func TestBootstrapRejectsZeroPlayerCount(t *testing.T) {
+	err := Bootstrap(
+		context.Background(),
+		Deps{Users: stubEnsurer{}, Lobby: nil, EngineVersions: nil},
+		config.DevSandboxConfig{
+			Email:         "dev@local.test",
+			EngineImage:   "galaxy-engine:local-dev",
+			EngineVersion: "0.0.0-local-dev",
+			PlayerCount:   0,
+		},
+		zap.NewNop(),
+	)
+	if err == nil {
+		t.Fatal("expected error on zero PlayerCount, got nil")
+	}
+}
+
+// TestBootstrapRejectsMissingDeps checks that a misconfigured wiring
+// (Email set but one of the required services nil) fails fast rather
+// than panicking when the bootstrap reaches its first service call.
+func TestBootstrapRejectsMissingDeps(t *testing.T) {
+	err := Bootstrap(
+		context.Background(),
+		Deps{Users: stubEnsurer{}, Lobby: nil, EngineVersions: nil},
+		config.DevSandboxConfig{
+			Email:         "dev@local.test",
+			EngineImage:   "galaxy-engine:local-dev",
+			EngineVersion: "0.0.0-local-dev",
+			PlayerCount:   20,
+		},
+		zap.NewNop(),
+	)
+	if err == nil {
+		t.Fatal("expected error on missing deps, got nil")
+	}
+	if !errors.Is(err, errMissingDepsSentinel) && err.Error() == "" {
+		// The exact wording is not part of the contract; this branch
+		// only asserts the error is non-nil and human-readable.
+		t.Fatalf("error has empty message: %v", err)
+	}
+}
+
+// errMissingDepsSentinel exists so the assertion above can compile;
+// the real error is constructed via errors.New inside Bootstrap and
+// is intentionally not exported. The test only needs to confirm the
+// returned error has a message.
+var errMissingDepsSentinel = errors.New("sentinel")
+
+type stubEnsurer struct{}
+
+func (stubEnsurer) EnsureByEmail(_ context.Context, _, _, _, _ string) (uuid.UUID, error) {
+	return uuid.UUID{}, nil
+}