Dev-only bulk delete all campaigns; deleteCollection SQL bulk + gates

Feature: debug button to wipe all campaigns/encounters/logs in dev builds.
Previously bulk delete fetched all logs per campaign, client-filtered,
batchWrite — 30s+/campaign. Now SQL bulk DELETE, no fetch.

Server (server/db.js, server/index.js):
- deleteCollection(collPath, {where}) — SQL DELETE FROM docs WHERE parent=?,
  optional where-filter. Broadcasts deletions to WS subscribers.
- DELETE /api/collection endpoint
- Gate: ALLOW_DEV_ENDPOINTS=1 env OR createServer({allowDevEndpoints:true})
- createServer accepts allowDevEndpoints param (tests bypass env)

Storage (src/storage/server.js, src/storage/firebase.js):
- deleteCollection(path, whereField, whereValue) both adapters
- Firebase: fetch matching + batch-delete (firestore no bulk), 500-chunk
- Gate: throws if NODE_ENV not development/test
- Contract-tested both backends

App (src/App.js):
- deleteCampaignCascade refactored (reusable, no try/catch split)
- handleDeleteAllCampaigns: Promise.all per campaign, deleteCollection for
  encounters (no fetch), deleteCollection logs once globally, parallel
- Button dev-gated (NODE_ENV), confirm modal, hidden when no campaigns

Mock fixes (surfaced by new tests):
- firebase firestore mock: added where() export, getDocs applies constraints
  (was returning all docs ignoring query constraints — pre-existing gap)

Tests:
- contract: deleteCollection (bulk, where-filter, empty) both backends
- server-contract: live deleteCollection (bulk, where, 403 gate)
- runStorageContract via makeStorage({allowDevEndpoints:true})

Safety (3 layers):
- UI button hidden in prod (NODE_ENV gate)
- storage method throws in prod (NODE_ENV gate)
- HTTP endpoint 403 in prod (env/param gate)

server/db.js

@@ -113,6 +113,25 @@ function makeStore(db, broadcast) {
     return db.prepare('SELECT COUNT(*) AS n FROM docs WHERE parent = ?').get(collPath).n;
   }
 
+  // Bulk delete whole collection or by where-filter. No fetch. SQL knows paths.
+  // DEV ONLY — guarded at HTTP layer; db fn itself unguarded (server-internal trust).
+  function deleteCollection(collPath, { where } = {}) {
+    let sql = 'DELETE FROM docs WHERE parent = ?';
+    const params = [collPath];
+    const changed = [];
+    if (where) {
+      if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(where.field)) throw new Error(`bad where field: ${where.field}`);
+      if (where.op !== '==') throw new Error(`unsupported where op: ${where.op}`);
+      sql += ` AND json_extract(data, '$.${where.field}') = ?`;
+      params.push(where.value);
+    }
+    // collect paths+parents for broadcast before delete
+    const rows = db.prepare('SELECT path, parent FROM docs WHERE parent = ?' + (where ? ` AND json_extract(data, '$.${where.field}') = ?` : '')).all(...params);
+    const info = db.prepare(sql).run(...params);
+    if (broadcast) rows.forEach(r => broadcast({ path: r.path, parent: r.parent, deleted: true }));
+    return info.changes;
+  }
+
   function batchWrite(ops) {
     const run = db.transaction((items) => {
       const changed = [];
@@ -151,7 +170,7 @@ function makeStore(db, broadcast) {
     return result;
   }
 
-  return { getDoc, setDoc, updateDoc, deleteDoc, getCollection, countCollection, batchWrite, transactionalUndo };
+  return { getDoc, setDoc, updateDoc, deleteDoc, getCollection, countCollection, deleteCollection, batchWrite, transactionalUndo };
 }
 
 module.exports = { openDb, parentOf, makeStore };