feat: proxy the BFF to Vite for single-origin HMR in one terminal window

[marekdano]

Summary

The BFF and frontend used to each need their own terminal (npm run dev in server/, npm run dev at root). npm run dev:all now starts both together with one command — down to a single terminal for those two, with the API in mcp-context-forge remaining the only other one needed.

• Local dev previously meant either a slow rebuild-and-refresh loop (build:watch, no HMR) or visiting Vite's dev server directly on :5173
  — which needs a separate /api/* route to the BFF and 403s on login/SSE/password-reset unless PUBLIC_ORIGIN is manually overridden to work around the BFF's origin-guard.
• The BFF now reverse-proxies everything it doesn't own itself (SPA shell, JS/CSS modules, HMR) to a running Vite dev server when VITE_DEV_SERVER_URL is set, via a new vite-dev-proxy plugin (@fastify/http-proxy) registered in place of the static-file plugin. /api/*, /auth/*, /healthz, and the auth-aware / redirect stay BFF-owned and unaffected — verified via manual route-precedence checks.
• The browser now only ever talks to the BFF's own origin (:3000), matching how the app is served in production, so there's no origin mismatch to configure around.
• Added npm run dev:bff and npm run dev:all (via concurrently) to start the BFF (with VITE_DEV_SERVER_URL set) and the Vite dev server together in one command.
• Added predev/predev:bff/predev:all npm lifecycle hooks that check node_modules is in sync before dev/dev:bff/dev:all run, so a missing install fails with a clear "run npm install" message instead of a bare command not found.
• predev:all also runs npm run generate before starting either dev server, so dev:all always has fresh src/generated/ types — both on a fresh clone (that directory is gitignored and 34 files import from it) and after editing openapi.json mid-session.
• Updated README and .env.example to document the new flow, alongside the existing build/build:watch path for testing the exact BFF-served bundle.

Test plan

• npm run build — succeeds
• npm run lint (in server/) — typechecks clean
• npm run dev:all from repo root: http://localhost:3000/ loads, redirects to /app/login when unauthed, HMR client/React-refresh correctly injected into /app/
• curl http://localhost:3000/healthz and /api/* still return BFF responses (not proxied to Vite)
• Simulated missing node_modules — dev, dev:bff, and dev:all each fail with the intended message instead of command not found
• Deleted src/generated/ — dev:all regenerates it via predev:all before either dev server starts