fix(login): devLoginConfig() returns null when endpoint absent, not false

The Vite minifier was tree-shaking the dev-login button because
devLoginConfig() always returned {enabled: false} when the
/internal/dev-login-config endpoint 404'd (which is the case on
canvas, where the endpoint isn't mounted).

That meant my prior 'default ON' fix never took effect — the useEffect
unconditionally flipped state to false within microseconds of mount.

Real fix: return {enabled: null} on absence. Only flip OFF when
endpoint explicitly says enabled=false. Otherwise honor the source
default.

Confidence: high
Scope-risk: narrow

src/scenes/Login.tsx

@@ -14,12 +14,10 @@ export default function Login() {
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
-    // The dev-login button is intentionally on by default on canvas
-    // (the user explicitly asked for it as a documented exception until
-    // we cut over fully to SSO). The endpoint config only flips it OFF.
+    // dev-login is on by default. Only the endpoint can flip it OFF.
     api.devLoginConfig()
       .then((cfg) => { if (cfg.enabled === false) setDevLoginEnabled(false); })
-      .catch(() => { /* endpoint not present — keep default ON */ });
+      .catch(() => { /* endpoint absent → keep ON */ });
   }, []);
 
   const handleSubmit = async (e: React.FormEvent) => {