fix(login): devLoginConfig() returns null when endpoint absent, not false

The Vite minifier was tree-shaking the dev-login button because
devLoginConfig() always returned {enabled: false} when the
/internal/dev-login-config endpoint 404'd (which is the case on
canvas, where the endpoint isn't mounted).

That meant my prior 'default ON' fix never took effect — the useEffect
unconditionally flipped state to false within microseconds of mount.

Real fix: return {enabled: null} on absence. Only flip OFF when
endpoint explicitly says enabled=false. Otherwise honor the source
default.

Confidence: high
Scope-risk: narrow

qa/probe_login.mjs

@@ -0,0 +1,21 @@
+import { chromium } from "playwright";
+const b = await chromium.launch({
+  headless: true,
+  args: [
+    "--host-resolver-rules=MAP canvas.flow-master.ai 65.21.71.186",
+    "--ignore-certificate-errors",
+  ],
+});
+const p = await b.newPage({ viewport: { width: 1440, height: 900 } });
+p.on("console", (m) => console.log("console", m.type(), m.text().slice(0, 200)));
+p.on("pageerror", (e) => console.log("pageerror", e.message));
+await p.goto("https://canvas.flow-master.ai/", { waitUntil: "networkidle" });
+await p.waitForTimeout(2000);
+console.log("--- DOM ---");
+console.log(await p.evaluate(() => document.body.innerHTML.slice(0, 3000)));
+console.log("--- visible text ---");
+console.log(await p.evaluate(() => document.body.innerText));
+console.log("--- buttons ---");
+const buttons = await p.$$eval("button, a", (els) => els.map((e) => `${e.tagName} disabled=${e.disabled} "${(e.innerText || e.textContent || "").slice(0, 60)}"`));
+buttons.forEach((b) => console.log(b));
+await b.close();