feat(dev): extend DEV_AUTH_BYPASS to skip the frontend Turnstile/human-verification gate (headless e2e)

[thewrz]

Why

DEV_AUTH_BYPASS (#555) opens the backend guest gates (human-verification + email) for headless testing, and backend Turnstile already self-disables in dev. But the frontend still renders the Turnstile / human-verification screen client-side, so browser-driven guest e2e (Playwright 02-guest-request, 04-search-pipeline) stalls — the guest page shows the Turnstile widget instead of the search form, and specs time out. This is the known gap called out when #555 merged.

What

Add a dev-only frontend escape so the client skips the Turnstile / human-verification UI when in dev:

• A NEXT_PUBLIC_DEV_AUTH_BYPASS (or similar) build-time flag that, in development only, makes the guest pages skip the Turnstile widget + human-verification bootstrap and proceed straight to the search/submit UI.
• Pair it with the backend DEV_AUTH_BYPASS so a single dev toggle enables full end-to-end headless guest testing (collect/join/kiosk).
• Prod-safety, same bar as the backend flag: must be inert in any production build (NEXT_PUBLIC_* is baked at build time — ensure prod builds never ship it enabled; ideally also gate on a runtime dev check). Never weaken the real Turnstile/human gate in production.

Notes / context

• Backend half is done (feat(dev): DEV_AUTH_BYPASS flag to skip guest gates for headless testing #555): DEV_AUTH_BYPASS + the prod-safe is_inert_dev_token guards.
• The frontend gate components to target: the Turnstile bootstrap + human-verification / NicknameGate flow on the guest pages.
• Once both halves exist, the ~/wrzdj-testing suite + Playwright e2e/ guest specs can run fully headless.

Testing

• Dev build with the flag: guest page renders the search form directly (no Turnstile screen)
• Playwright 02-guest-request / 04-search-pipeline pass headless against a dev stack with both flags on
• Production build: flag inert; Turnstile/human gate still enforced