In local development, the PDS runs on plain HTTP (localhost:2583) rather than behind TLS. The standard OAuth DPOP flow requires HTTPS, so we need a simplified auth flow for dev mode that exchanges credentials directly with the local PDS.
Add DevStartAuthFlow() which calls createSession on the local PDS and stores the resulting tokens in the session. Wire it into the login handler when Dev mode is enabled.
AI-assisted: GitLab Duo Agentic Chat (Claude Opus 4.6) Signed-off-by: Alessio Caiazza code.git@caiazza.info