feat(dev-start): true single-command spinup — infra + templates + auth posture

[HongmingWang-Rabbit]

Summary

Manual fresh-user clean-slate test surfaced three friction points in the existing `scripts/dev-start.sh` (which existed but was undocumented and incomplete). This PR makes `./scripts/dev-start.sh` a true single command from `git clone` to a usable canvas, and updates the quickstart doc to lead with it.

Friction the prior script had

#	Issue	Fix
1	Ran `docker compose -f docker-compose.infra.yml` directly, bypassing `infra/scripts/setup.sh` → no template registry → "Template palette is empty"	Calls `setup.sh` which brings up full infra and populates templates from `manifest.json`
2	`ADMIN_TOKEN` not handled. Fail-open closed after first workspace token → canvas 401s with no recovery path	Writes `MOLECULE_ENV=development` to `.env` to activate the dev-mode auth hatch (middleware.isDevModeFailOpen())
3	Not mentioned in `docs/quickstart.md` — new users followed the 4-step manual flow	Quickstart now leads with the one-command path; manual flow demoted to "Manual setup (advanced)"

Why NOT auto-generate ADMIN_TOKEN

A first attempt did. It broke the canvas because:

```go
func isDevModeFailOpen() bool {
if os.Getenv("ADMIN_TOKEN") != "" {
return false // any ADMIN_TOKEN closes the hatch
}
env := os.Getenv("MOLECULE_ENV")
return env == "development" || env == "dev"
}
```

ADMIN_TOKEN being set closes the hatch, and the canvas has no `NEXT_PUBLIC_ADMIN_TOKEN` bake step to receive a token in a dev build. The .env comment block explicitly warns future contributors not to add ADMIN_TOKEN to dev .env.

Other improvements

• Both background processes' logs go to `/tmp/molecule-{platform,canvas}.log` so the readiness banner stays clean instead of stdout-mixed
• Health-poll loops cap at 30s with timeout errors pointing to the log file (was: infinite hang)
• Readiness banner tells the user the next step ("open localhost:3000 → add API key in Config → Secrets & API Keys → Global"), not just service URLs

Verification

Tested end-to-end from full clean Docker (no containers, no volumes, no `.env`) three times:

Phase	Wall-clock
infra (setup.sh)	~10s
Platform build + ready	~2s
Canvas dev start	~3s
Total re-run	~12s
First run + npm install + docker pulls	~2 min

Confirmed:

• ✓ `/workspaces` returns 200 without bearer (dev-mode hatch active)
• ✓ `/templates` returns 8 templates (registry populated from manifest)
• ✓ Canvas serves at HTTP 200
• ✓ `.env` correctly contains only `MOLECULE_ENV=development` (no `ADMIN_TOKEN` leak)
• ✓ Banner output matches the design above

Test plan

• Fresh clean-slate test from no .env, no containers, no volumes → 12s to ready
• Re-run preserves `.env`
• Canvas can call admin endpoints without bearer
• Templates populated
• CI: `shellcheck` on the script (existing convention)
• Manual: someone other than me follows the new quickstart from a fresh clone

🤖 Generated with Claude Code