Make dev mode one command and add VS Code config

npm run dev now runs scripts/dev-env.ts first, which creates .dev/site.env with
a known dev password and a random session secret, so a fresh clone serves a
working admin without anyone hand-building a hash. Adds .vscode launch
configurations and tasks for the dev server, one test file, and check-site, and
brings scripts/ under typecheck, which it had been missing.

README.md

@@ -54,27 +54,55 @@ deploy.sh                 Tests, build, push
 The Ansible playbook lives in `ansible-playbooks/menu-admin/`, beside the other
 playbooks, because that is where it is run from.
 
-## Working on it
+## Running it locally
 
-Node 24 or newer runs the TypeScript sources directly.
+Node 24 or newer runs the TypeScript sources directly; there is no build step.
 
 ```sh
 npm install
-npm test          # node:test
-npm run typecheck # tsc --noEmit
-npm run seed      # placeholder Pages in .dev/data, for design review
+npm run seed      # placeholder Pages in .dev (wipes .dev/data; for looking at the design)
 npm run dev       # http://localhost:3000 against .dev
 ```
 
-To sign in locally, put a password hash in `.dev/site.env`:
+`npm run dev` first runs `scripts/dev-env.ts`, which creates `.dev/site.env` on
+first use with the password `menu-dev-password` (override with
+`DEV_ADMIN_PASSWORD=...`) and a random session secret, then starts the server
+with `--watch`. Sign in at <http://localhost:3000/admin>.
+
+The file is gitignored and development only: the dev server runs with
+`SECURE_COOKIES=false` over http, and that password is a known constant. On the
+server the same file is written by `scripts/provision-site-env.sh` with a hash of
+the real password and mode 600.
+
+Tests and checks:
 
 ```sh
-printf 'ADMIN_PASSWORD_HASH=%s\nSESSION_SECRET=%s\n' \
-  "$(node -e "import('./src/auth.ts').then(async m => process.stdout.write(await m.hashPassword('your password')))")" \
-  "$(node -e "process.stdout.write(require('node:crypto').randomBytes(32).toString('base64url'))")" \
-  > .dev/site.env
+npm test                                      # node:test
+npm run typecheck                             # tsc --noEmit, scripts/ included
+npm run verify                                # integrity of .dev/data
+npm run check-site -- http://127.0.0.1:3000   # checks a running site from outside
 ```
 
+### In VS Code
+
+`.vscode/` holds launch configurations and tasks.
+
+| Configuration | What it does |
+| --- | --- |
+| **Dev server (debug)** | runs `src/server.ts` with the dev environment, breakpoints live |
+| **Dev server (watch, no debugger)** | `npm run dev` in a terminal |
+| **Debug the open test file** | runs the file you have open under `node --test`, with child processes attached so breakpoints inside a test bind |
+| **Check the running site** | prompts for a URL and runs `scripts/check-site.ts` |
+
+Breakpoints land in the `.ts` files themselves: Node strips types in place, so
+line numbers are the ones you see. The debug configuration creates `.dev/site.env`
+first (`preLaunchTask`), so a fresh clone serves a working admin immediately.
+
+Tasks (Command Palette → *Run Task*) cover the same ground: seed, the dev server,
+tests, typecheck, verify and repair. `.dev`, `.tmp` and `.npm-cache` are hidden
+from the explorer, search and the file watcher, so a watched server does not
+restart on its own data writes.
+
 ## Who can do what
 
 `/` and `/<section>/` are public. `/admin` needs the password; a Draft's Pages