fix(login): default devLoginEnabled to true on canvas

The /internal/dev-login-config endpoint is a fm-shell Next.js internal
route that doesn't exist on the canvas nginx. Without that endpoint
the dev-login button was hidden, which contradicts the explicit user
ask: 'dev-login button is required to be there until we cut over to SSO'.

Fix: default state to true, treat the config endpoint as 'flip OFF only'.
If the endpoint returns enabled:false we hide. Otherwise (404, network
error, etc.) we keep the button visible.

Confidence: high
Scope-risk: narrow
Not-tested: real /internal/dev-login-config returning enabled:false (would
   need that endpoint mounted on canvas — out of scope for now)

src/scenes/Login.tsx

@@ -9,13 +9,17 @@ export default function Login() {
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
   const [rememberMe, setRememberMe] = useState(false);
-  const [devLoginEnabled, setDevLoginEnabled] = useState(false);
+  const [devLoginEnabled, setDevLoginEnabled] = useState(true);
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
-    // Check if dev login is enabled
-    api.devLoginConfig().then((cfg) => setDevLoginEnabled(cfg.enabled));
+    // The dev-login button is intentionally on by default on canvas
+    // (the user explicitly asked for it as a documented exception until
+    // we cut over fully to SSO). The endpoint config only flips it OFF.
+    api.devLoginConfig()
+      .then((cfg) => { if (cfg.enabled === false) setDevLoginEnabled(false); })
+      .catch(() => { /* endpoint not present — keep default ON */ });
   }, []);
 
   const handleSubmit = async (e: React.FormEvent) => {