chore(dev): enable password registration in local dev

scripts/dev.mjs

@@ -958,16 +958,11 @@ class DevRunner {
   async startApiServer(service) {
     await this.ensureApiServerSpacetimeToken();
 
-    const mergedEnv = {
-      ...this.baseEnv,
-      GENARRATIVE_API_HOST: this.options.apiHost,
-      GENARRATIVE_API_PORT: String(this.options.apiPort),
-      GENARRATIVE_API_LOG: this.options.apiLog,
-      GENARRATIVE_SPACETIME_SERVER_URL: this.state.spacetimeServer,
-      GENARRATIVE_SPACETIME_DATABASE: this.options.database,
-      GENARRATIVE_SPACETIME_TOKEN:
-        this.baseEnv.GENARRATIVE_SPACETIME_TOKEN || '',
-    };
+    const mergedEnv = buildApiServerProcessEnv({
+      baseEnv: this.baseEnv,
+      options: this.options,
+      state: this.state,
+    });
 
     const logFile = resolveApiServerLogFile(repoRoot, mergedEnv);
     ensureParentDir(logFile);
@@ -1717,10 +1712,25 @@ function isSpacetimePublishPermissionError(error) {
   );
 }
 
+function buildApiServerProcessEnv({baseEnv, options, state}) {
+  return {
+    ...baseEnv,
+    // 本地 dev 允许密码入口直接创建账号，生产默认仍由 api-server 配置保持关闭。
+    GENARRATIVE_DEV_PASSWORD_ENTRY_AUTO_REGISTER_ENABLED: 'true',
+    GENARRATIVE_API_HOST: options.apiHost,
+    GENARRATIVE_API_PORT: String(options.apiPort),
+    GENARRATIVE_API_LOG: options.apiLog,
+    GENARRATIVE_SPACETIME_SERVER_URL: state.spacetimeServer,
+    GENARRATIVE_SPACETIME_DATABASE: options.database,
+    GENARRATIVE_SPACETIME_TOKEN: baseEnv.GENARRATIVE_SPACETIME_TOKEN || '',
+  };
+}
+
 export {
   DevRunner,
   assertReusableSpacetimeProcessVersionMatchesWorkspace,
   assertSpacetimeToolVersionMatchesWorkspace,
+  buildApiServerProcessEnv,
   buildSpacetimePublishArgs,
   createDevServerSpawnOptions,
   createWatchConfigs,