Dev-only bulk delete all campaigns; deleteCollection SQL bulk + gates

Feature: debug button to wipe all campaigns/encounters/logs in dev builds.
Previously bulk delete fetched all logs per campaign, client-filtered,
batchWrite — 30s+/campaign. Now SQL bulk DELETE, no fetch.

Server (server/db.js, server/index.js):
- deleteCollection(collPath, {where}) — SQL DELETE FROM docs WHERE parent=?,
  optional where-filter. Broadcasts deletions to WS subscribers.
- DELETE /api/collection endpoint
- Gate: ALLOW_DEV_ENDPOINTS=1 env OR createServer({allowDevEndpoints:true})
- createServer accepts allowDevEndpoints param (tests bypass env)

Storage (src/storage/server.js, src/storage/firebase.js):
- deleteCollection(path, whereField, whereValue) both adapters
- Firebase: fetch matching + batch-delete (firestore no bulk), 500-chunk
- Gate: throws if NODE_ENV not development/test
- Contract-tested both backends

App (src/App.js):
- deleteCampaignCascade refactored (reusable, no try/catch split)
- handleDeleteAllCampaigns: Promise.all per campaign, deleteCollection for
  encounters (no fetch), deleteCollection logs once globally, parallel
- Button dev-gated (NODE_ENV), confirm modal, hidden when no campaigns

Mock fixes (surfaced by new tests):
- firebase firestore mock: added where() export, getDocs applies constraints
  (was returning all docs ignoring query constraints — pre-existing gap)

Tests:
- contract: deleteCollection (bulk, where-filter, empty) both backends
- server-contract: live deleteCollection (bulk, where, 403 gate)
- runStorageContract via makeStorage({allowDevEndpoints:true})

Safety (3 layers):
- UI button hidden in prod (NODE_ENV gate)
- storage method throws in prod (NODE_ENV gate)
- HTTP endpoint 403 in prod (env/param gate)

src/__mocks__/firebase/firestore.js

@@ -13,6 +13,7 @@ export function doc(db, path, extra) {
 }
 export function collection(db, path) { return ref(path); }
 export function query(refOrColl, ...constraints) { return { ref: refOrColl, constraints }; }
+export function where(field, op, value) { return { __type: 'where', field, op, value }; }
 export function orderBy(field, dir) { return { __type: 'orderBy', field, dir }; }
 export function limit(n) { return { __type: 'limit', n }; }
 
@@ -67,7 +68,9 @@ export async function getDoc(docRef) {
 }
 export async function getDocs(collRefOrQuery) {
   const collPath = collRefOrQuery.ref ? collRefOrQuery.ref.path : collRefOrQuery.path;
-  const docs = MOCK_DB.collection(collPath);
+  let docs = MOCK_DB.collection(collPath);
+  const constraints = collRefOrQuery.constraints || [];
+  docs = applyConstraints(docs, constraints);
   return { docs: docs.map(d => ({ id: d.id, data: () => d.data, ref: { path: `${collPath}/${d.id}` } })) };
 }
 
@@ -118,6 +121,8 @@ function applyConstraints(docs, constraints) {
       });
     } else if (c.__type === 'limit') {
       out = out.slice(0, c.n);
+    } else if (c.__type === 'where') {
+      out = out.filter(d => d.data[c.field] === c.value);
     }
   }
   return out;