feat: add a dev-only login and seed command

src/Controller/DevLoginController.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use App\Repository\UserRepository;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\DependencyInjection\Attribute\When;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Dev-only "log in as" picker, standing in for OAuth2 against myep until the client is
+ * registered there (plan step 6).
+ *
+ * Deliberately carries no #[Route] attribute: the routes are declared in
+ * config/routes/dev_login.yaml under `when@dev`, so this cannot be reached in any other
+ * environment even if the class were somehow registered.
+ */
+#[When('dev')]
+final class DevLoginController extends AbstractController
+{
+    public function __construct(private readonly UserRepository $users)
+    {
+    }
+
+    public function login(): Response
+    {
+        if ($this->getUser()) {
+            return $this->redirectToRoute('app_dashboard');
+        }
+
+        // POST never reaches here -- DevLoginAuthenticator intercepts it on the firewall.
+        return $this->render('dev/login.html.twig', [
+            'users' => $this->users->findBy([], ['name' => 'ASC']),
+        ]);
+    }
+}

src/Controller/SecurityController.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\Routing\Attribute\Route;
+
+/**
+ * Gains /auth/init and /auth/check when OAuth2 against myep lands (plan step 6).
+ */
+final class SecurityController extends AbstractController
+{
+    /**
+     * Never executed: the firewall's logout listener intercepts this route.
+     */
+    #[Route('/logout', name: 'app_logout', methods: ['GET'])]
+    public function logout(): never
+    {
+        throw new \LogicException('Intercepted by the logout key on the main firewall.');
+    }
+}