Dev-only bulk delete all campaigns; deleteCollection SQL bulk + gates

Feature: debug button to wipe all campaigns/encounters/logs in dev builds.
Previously bulk delete fetched all logs per campaign, client-filtered,
batchWrite — 30s+/campaign. Now SQL bulk DELETE, no fetch.

Server (server/db.js, server/index.js):
- deleteCollection(collPath, {where}) — SQL DELETE FROM docs WHERE parent=?,
  optional where-filter. Broadcasts deletions to WS subscribers.
- DELETE /api/collection endpoint
- Gate: ALLOW_DEV_ENDPOINTS=1 env OR createServer({allowDevEndpoints:true})
- createServer accepts allowDevEndpoints param (tests bypass env)

Storage (src/storage/server.js, src/storage/firebase.js):
- deleteCollection(path, whereField, whereValue) both adapters
- Firebase: fetch matching + batch-delete (firestore no bulk), 500-chunk
- Gate: throws if NODE_ENV not development/test
- Contract-tested both backends

App (src/App.js):
- deleteCampaignCascade refactored (reusable, no try/catch split)
- handleDeleteAllCampaigns: Promise.all per campaign, deleteCollection for
  encounters (no fetch), deleteCollection logs once globally, parallel
- Button dev-gated (NODE_ENV), confirm modal, hidden when no campaigns

Mock fixes (surfaced by new tests):
- firebase firestore mock: added where() export, getDocs applies constraints
  (was returning all docs ignoring query constraints — pre-existing gap)

Tests:
- contract: deleteCollection (bulk, where-filter, empty) both backends
- server-contract: live deleteCollection (bulk, where, 403 gate)
- runStorageContract via makeStorage({allowDevEndpoints:true})

Safety (3 layers):
- UI button hidden in prod (NODE_ENV gate)
- storage method throws in prod (NODE_ENV gate)
- HTTP endpoint 403 in prod (env/param gate)

server/tests/server-contract.test.js

@@ -16,9 +16,9 @@ const { runStorageContract } = require('../../src/storage/contract');
 
 // Factory: fresh backend (unique sqlite file) + storage pointed at it.
 // Disposing the storage closes the backend so each test is fully isolated.
-async function makeStorage() {
+async function makeStorage({ allowDevEndpoints = false } = {}) {
   const dbPath = path.join(os.tmpdir(), `ws-contract-${Date.now()}-${Math.random().toString(36).slice(2)}.sqlite`);
-  const handle = createServer({ dbPath, port: 0 });
+  const handle = createServer({ dbPath, port: 0, allowDevEndpoints });
   await new Promise((resolve, reject) => {
     handle.server.on('error', reject);
     handle.server.listen(0, resolve);
@@ -31,7 +31,7 @@ async function makeStorage() {
   return storage;
 }
 
-runStorageContract('server (live backend)', makeStorage);
+runStorageContract('server (live backend)', () => makeStorage({ allowDevEndpoints: true }));
 
 describe('server-side query constraints', () => {
   let storage;
@@ -75,3 +75,41 @@ describe('server-side query constraints', () => {
     expect(res).toEqual({ count: 5 });
   });
 });
+
+describe('DELETE /api/collection (bulk delete)', () => {
+  let storage;
+  beforeEach(async () => {
+    storage = await makeStorage({ allowDevEndpoints: true });
+  });
+  afterEach((done) => storage.dispose(done));
+
+  test('deletes all docs in collection, no fetch', async () => {
+    for (let i = 0; i < 3; i++) await storage.addDoc('logs', { type: 'x', n: i });
+    const res = await storage._api('DELETE', '/api/collection', { path: 'logs' });
+    expect(res.ok).toBe(true);
+    expect(res.deleted).toBe(3);
+    const after = await storage._api('GET', '/api/collection/count', { path: 'logs' });
+    expect(after.count).toBe(0);
+  });
+
+  test('honors whereField filter', async () => {
+    await storage.addDoc('logs', { type: 'keep', n: 1 });
+    await storage.addDoc('logs', { type: 'drop', n: 2 });
+    await storage.addDoc('logs', { type: 'drop', n: 3 });
+    const res = await storage._api('DELETE', '/api/collection',
+      { path: 'logs', whereField: 'type', whereValue: 'drop' });
+    expect(res.deleted).toBe(2);
+    const after = await storage._api('GET', '/api/collection/count', { path: 'logs' });
+    expect(after.count).toBe(1);
+  });
+
+  test('403 when ALLOW_DEV_ENDPOINTS not set', async () => {
+    const gated = await makeStorage({ allowDevEndpoints: false });
+    let errMsg = null;
+    try {
+      await gated._api('DELETE', '/api/collection', { path: 'logs' });
+    } catch (e) { errMsg = e.message; }
+    expect(errMsg).toMatch(/403/);
+    await new Promise((resolve) => gated.dispose(resolve));
+  });
+});