fix(boot): refuse development mode settings outside localhost #431

Why

With NODE_ENV=development the server creates per-instance signing keys on disk, serves /docs, honours DISABLE_AUTH_RATE_LIMITS and FIDO_CONFORMANCE_MODE, and falls back to guessable development secrets when the service token is unset. The bundled docker-compose.yml sets development mode, and nothing stops that file, or a copy of it, reaching a public host.

What

• At boot, when development mode is on and the configured issuer or origins are not local (localhost, 127.0.0.1, *.localhost, *.test), refuse to start with an error naming each insecure setting, unless SEAMLESS_ALLOW_INSECURE_DEV=true is set
• Report insecure mode on /health/status whenever it is active
• Minor changeset, since a misconfigured deployment that boots today will stop booting

Done when

A deployment cannot run on a public origin in development mode by accident, and the health endpoint says so when it is allowed on purpose.