fix(login): devLoginConfig() returns null when endpoint absent, not false

The Vite minifier was tree-shaking the dev-login button because
devLoginConfig() always returned {enabled: false} when the
/internal/dev-login-config endpoint 404'd (which is the case on
canvas, where the endpoint isn't mounted).

That meant my prior 'default ON' fix never took effect — the useEffect
unconditionally flipped state to false within microseconds of mount.

Real fix: return {enabled: null} on absence. Only flip OFF when
endpoint explicitly says enabled=false. Otherwise honor the source
default.

Confidence: high
Scope-risk: narrow

src/lib/api.ts

@@ -210,17 +210,18 @@ export const api = {
     return data;
   },
 
-  async devLoginConfig(signal?: AbortSignal): Promise<{ enabled: boolean }> {
+  async devLoginConfig(signal?: AbortSignal): Promise<{ enabled: boolean | null }> {
     try {
       const init: RequestInit = { method: "GET", headers: { "Accept": "application/json" }, signal };
       const r = await instrumentedFetch("GET", `${this.config.baseUrl}/internal/dev-login-config`, init);
       if (r.ok) {
-        return await r.json() as { enabled: boolean };
+        const body = await r.json() as { enabled: boolean };
+        return { enabled: !!body.enabled };
       }
     } catch {
-      // swallow
+      // network/parse error — caller treats null as "no opinion"
     }
-    return { enabled: false };
+    return { enabled: null };
   },
 
   async workItems(signal?: AbortSignal): Promise<WorkItem[]> {