feat(admin-auth): add dev-only QR bypass via ?devBypassAdmin=true

Fabricates a local admin session and activates it directly, skipping the
Telegram QR flow, for local testing without a reachable session backend.
Guarded by environment.production at runtime - no-ops in production
builds even if this code ships.

src/app/app.ts

@@ -85,7 +85,13 @@ export class App implements OnInit {
     this.checkServerHealth();
   }
 
-  /** ?login=true / ?adminLogin=true open the respective login dialog for manual testing. No effect when absent. */
+  /**
+   * ?login=true / ?adminLogin=true open the respective login dialog for
+   * manual testing. ?devBypassAdmin=true skips the QR flow entirely and
+   * activates a fake local admin session - dev builds only, no effect (and
+   * no-ops server-side too, see AdminAuthService.devBypassLogin) in
+   * production. No effect when the params are absent.
+   */
   private openLoginDialogsFromTestModeQueryParams(): void {
     if (typeof window === 'undefined') {
       return;
@@ -97,6 +103,9 @@ export class App implements OnInit {
     if (params.get('adminLogin') === 'true') {
       this.adminAuthService.requestLogin();
     }
+    if (params.get('devBypassAdmin') === 'true') {
+      this.adminAuthService.devBypassLogin();
+    }
   }
 
   private setupAutoUpdates(): void {

src/app/core/admin-auth/admin-auth.service.ts

@@ -3,6 +3,7 @@ import { Observable, tap } from 'rxjs';
 import { AdminAuthStatus } from '../../models/admin-auth.model';
 import { AuthSession, WebSessionStart } from '../../models/auth.model';
 import { TelegramSessionApiService } from '../../services/telegram-session-api.service';
+import { environment } from '../../../environments/environment';
 
 /**
  * Admin login uses the exact same Telegram QR/session API as the customer
@@ -89,6 +90,28 @@ export class AdminAuthService {
     this.showLoginSignal.set(true);
   }
 
+  /**
+   * Dev-only shortcut for local testing without a reachable Telegram/session
+   * backend: fabricates a local session and activates it directly, skipping
+   * the QR flow entirely. No-ops in production builds (checked at runtime,
+   * not just build-time, so it is safe even if this code ships). Never call
+   * this from anywhere reachable in a production build.
+   */
+  devBypassLogin(): void {
+    if (environment.production) {
+      return;
+    }
+    this.hideLogin();
+    this.activateSession({
+      sessionId: `dev-bypass-${Date.now()}`,
+      userId: 0,
+      username: 'dev-admin',
+      displayName: 'Dev Admin (local bypass)',
+      active: true,
+      expires: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+    });
+  }
+
   hideLogin(): void {
     this.showLoginSignal.set(false);
   }