Dev login

No OAuth here. Picking a user just sets an unsigned dummy_session cookie holding that user's id. Enough to exercise role checks; not real auth.

• Log in as Ada (admin) admin
• Log in as Bob (user) user
• Log in as Cleo (user) user