Dev sign-in by role (placeholder for SSO). Capability checks are enforced server-side.