feat: add a dev-only login and seed command

config/packages/security.yaml

@@ -1,39 +1,37 @@
 security:
-    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
-    password_hashers:
-        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
+    # No password_hashers: there are no passwords here. Authentication is OAuth2 against myep
+    # (plan step 6); until that lands there is no way to log in outside dev.
 
-    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
     providers:
-        users_in_memory: { memory: null }
+        app_user_provider:
+            entity:
+                class: App\Entity\User
+                property: email
 
     firewalls:
         dev:
-            # Ensure dev tools and static assets are always allowed
-            pattern: ^/(_profiler|_wdt|assets|build)/
+            pattern: ^/(_profiler|_wdt|assets)/
             security: false
         main:
             lazy: true
-            provider: users_in_memory
+            provider: app_user_provider
+            logout:
+                path: app_logout
 
-            # Activate different ways to authenticate:
-            # https://symfony.com/doc/current/security.html#the-firewall
-
-            # https://symfony.com/doc/current/security/impersonating_user.html
-            # switch_user: true
-
-    # Note: Only the *first* matching rule is applied
     access_control:
-        # - { path: ^/admin, roles: ROLE_ADMIN }
-        # - { path: ^/profile, roles: ROLE_USER }
+        # ROLE_EMPLOYEE is the gate, not ROLE_USER: myep authenticates more people than are staff,
+        # and only staff may book a desk here.
+        - { path: ^/dev/, roles: PUBLIC_ACCESS }
+        - { path: ^/, roles: ROLE_EMPLOYEE }
 
-when@test:
+when@dev:
     security:
-        password_hashers:
-            # Password hashers are resource-intensive by design to ensure security.
-            # In tests, it's safe to reduce their cost to improve performance.
-            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
-                algorithm: auto
-                cost: 4 # Lowest possible value for bcrypt
-                time_cost: 3 # Lowest possible value for argon
-                memory_cost: 10 # Lowest possible value for argon
+        firewalls:
+            main:
+                # Real login is blocked on OAuth2 client registration on myep. Until then
+                # /dev/login lists the seeded users and logs one in without credentials.
+                # The entry point, the route and the controller are all dev-only, so this
+                # cannot leak into another environment by accident.
+                entry_point: App\Security\DevLoginEntryPoint
+                custom_authenticators:
+                    - App\Security\DevLoginAuthenticator

config/routes/dev_login.yaml

@@ -0,0 +1,7 @@
+# Dev-only stand-in for the OAuth2 login. The controller carries no #[Route] attribute, so
+# outside dev this route simply does not exist.
+when@dev:
+    app_dev_login:
+        path: /dev/login
+        controller: App\Controller\DevLoginController::login
+        methods: [GET, POST]