fix(control): allow login when HTTP server is stopped

Mount auth routes on the control plane and proxy /api/auth to :8600 in
dev:pm2 so the UI can authenticate while the HTTP API process is down.

Co-authored-by: Cursor <cursoragent@cursor.com>

packages/server/dev-pm2.mjs

@@ -108,7 +108,7 @@ run(
   ["--filter", "@jerapah-flow/web", "dev"],
   {
     env: {
-      // vite.config reads nothing; port is set in vite.config.js
+      JFLOW_AUTH_PROXY: "http://127.0.0.1:8600",
     },
   },
 );