Dev-only bulk delete all campaigns; deleteCollection SQL bulk + gates

Feature: debug button to wipe all campaigns/encounters/logs in dev builds.
Previously bulk delete fetched all logs per campaign, client-filtered,
batchWrite — 30s+/campaign. Now SQL bulk DELETE, no fetch.

Server (server/db.js, server/index.js):
- deleteCollection(collPath, {where}) — SQL DELETE FROM docs WHERE parent=?,
  optional where-filter. Broadcasts deletions to WS subscribers.
- DELETE /api/collection endpoint
- Gate: ALLOW_DEV_ENDPOINTS=1 env OR createServer({allowDevEndpoints:true})
- createServer accepts allowDevEndpoints param (tests bypass env)

Storage (src/storage/server.js, src/storage/firebase.js):
- deleteCollection(path, whereField, whereValue) both adapters
- Firebase: fetch matching + batch-delete (firestore no bulk), 500-chunk
- Gate: throws if NODE_ENV not development/test
- Contract-tested both backends

App (src/App.js):
- deleteCampaignCascade refactored (reusable, no try/catch split)
- handleDeleteAllCampaigns: Promise.all per campaign, deleteCollection for
  encounters (no fetch), deleteCollection logs once globally, parallel
- Button dev-gated (NODE_ENV), confirm modal, hidden when no campaigns

Mock fixes (surfaced by new tests):
- firebase firestore mock: added where() export, getDocs applies constraints
  (was returning all docs ignoring query constraints — pre-existing gap)

Tests:
- contract: deleteCollection (bulk, where-filter, empty) both backends
- server-contract: live deleteCollection (bulk, where, 403 gate)
- runStorageContract via makeStorage({allowDevEndpoints:true})

Safety (3 layers):
- UI button hidden in prod (NODE_ENV gate)
- storage method throws in prod (NODE_ENV gate)
- HTTP endpoint 403 in prod (env/param gate)

src/storage/contract.js

@@ -209,6 +209,32 @@ function runStorageContract(name, factory) {
       });
     });
 
+    describe('deleteCollection', () => {
+      test('deletes all docs in collection', async () => {
+        await storage.addDoc('logs', { type: 'a' });
+        await storage.addDoc('logs', { type: 'b' });
+        const deleted = await storage.deleteCollection('logs');
+        expect(deleted).toBe(2);
+        const remaining = await storage.getCollection('logs');
+        expect(remaining).toHaveLength(0);
+      });
+
+      test('honors whereField filter', async () => {
+        await storage.addDoc('logs', { type: 'keep', n: 1 });
+        await storage.addDoc('logs', { type: 'drop', n: 2 });
+        await storage.addDoc('logs', { type: 'drop', n: 3 });
+        const deleted = await storage.deleteCollection('logs', 'type', 'drop');
+        expect(deleted).toBe(2);
+        const remaining = await storage.getCollection('logs');
+        expect(remaining).toHaveLength(1);
+      });
+
+      test('empty collection returns 0', async () => {
+        const deleted = await storage.deleteCollection('logs');
+        expect(deleted).toBe(0);
+      });
+    });
+
     describe('subscribeDoc', () => {
       test('fires cb immediately with current value', async () => {
         await storage.setDoc('campaigns/a', { name: 'Alpha' });

src/storage/firebase.js

@@ -130,6 +130,27 @@ export function createFirebaseStorage() {
       await batch.commit();
     },
 
+    // Bulk delete collection (optionally where-filtered). Firestore has no
+    // single bulk-by-path op: fetch matching docs, batch-delete in chunks
+    // of 500 (firestore batch limit). DEV ONLY.
+    async deleteCollection(path, whereField, whereValue) {
+      if (process.env.NODE_ENV !== 'development' && process.env.NODE_ENV !== 'test') {
+        throw new Error('deleteCollection: dev only');
+      }
+      let q = collection(db, path);
+      if (whereField) q = query(q, where(whereField, '==', whereValue));
+      const snap = await getDocsReal(q);
+      const docs = snap.docs;
+      let count = 0;
+      for (let i = 0; i < docs.length; i += 500) {
+        const batch = writeBatch(db);
+        for (const d of docs.slice(i, i + 500)) batch.delete(d.ref);
+        await batch.commit();
+        count += Math.min(500, docs.length - i);
+      }
+      return count;
+    },
+
     // Transactional undo via batch (atomic in firestore). Apply updates +
     // flip undone flag in single commit.
     async undo({ logPath, undo, redo = false }) {

src/storage/server.js

@@ -204,6 +204,19 @@ function createServerStorage({ baseUrl, realtimeUrl } = {}) {
       await api('DELETE', '/api/doc', { path: p });
     },
 
+    // Bulk delete collection (optionally where-filtered). No fetch. SQL DELETE.
+    // DEV ONLY. Method ships in prod build but throws if not dev.
+    async deleteCollection(rawCollPath, whereField, whereValue) {
+      if (process.env.NODE_ENV !== 'development' && process.env.NODE_ENV !== 'test') {
+        throw new Error('deleteCollection: dev only');
+      }
+      const p = norm(rawCollPath);
+      const query = { path: p };
+      if (whereField) { query.whereField = whereField; query.whereValue = whereValue; }
+      const res = await api('DELETE', '/api/collection', query);
+      return res.deleted;
+    },
+
     async addDoc(rawCollPath, data) {
       const p = norm(rawCollPath);
       const res = await api('POST', '/api/collection', null, { path: p, data });