fix(auth): dev-only bypass for the email allowlist so local development stays frictionless

[parthrohit22]

Task

The admin-managed email allowlist (#374/#375) blocks normal local development: a fresh npm run dev:backend + npm run dev:frontend checkout can no longer register/sign in without first running scripts/approve_email.py by hand. Add a dev-only bypass so local development works exactly as it did before the allowlist existed, while production keeps enforcing it exactly as-is.

Rationale

The allowlist is a real, intentional production access-control decision (#374) — this is not a rollback of it. It's specifically about restoring the previous frictionless npm run dev experience for contributors, matching the existing app_env-gated leniency pattern already used elsewhere in Settings (AUTH_SECRET_KEY, AI_ENCRYPTION_KEY both substitute safe defaults outside production, never in it).

Acceptance Criteria

• In development mode specifically, registration (and OAuth first-time sign-in) works with no invite/approval step, identical to pre-feat(auth): replace invite-code registration with an admin-managed email allowlist #374 behavior.
• Production enforcement is completely unchanged -- verified by the existing allowlist-rejection tests still passing.
• The bypass is scoped narrowly enough that it does not silently weaken the backend test suite's own coverage of allowlist rejection (the suite currently runs under the same default app_env a real local dev server does, so this needs a deliberate, explicit distinction, not just reusing the existing dev/test leniency pattern verbatim).
• Verified for real: both dev servers started fresh, a real signup completed locally with zero prior setup.