Add MFE developer mode serving apps from a local dev server

What does this MR do and why?

Part 7 (final) of the registry-direct MFE series: developer mode — serve an MFE from a local dev server with HMR, no proxy required.

• GITLAB_MFE_DEV_SERVERS="duo_chat=http://localhost:5173" makes the resolver serve that app from the dev server ahead of overrides and baked versions — development environment only (the helpers return nothing elsewhere, regardless of env vars).
• The loader registers {dev_server}/mf-manifest.json directly with no verification, no SRI, and no baked fallback: dev bytes mutate on every keystroke, and a broken dev server should fail loudly rather than be masked by a silent downgrade.
• HMR websockets connect straight to the dev origin; development-only CSP additions admit the configured dev-server origins (http + ws). Production CSP is untouched.
• A dev app does not need to be baked — brand-new micro-frontends can be developed before ever being published. Feature flags (mfe_enabled + per-surface) still gate every mount, keeping dev wiring identical to production.

Unlike the previous approach, there is no Rails proxy controller: in the registry-direct architecture the browser already loads MFEs cross-origin, so a local dev server is just another origin.

How to verify

bin/rspec spec/lib/gitlab/mfe_spec.rb spec/lib/gitlab/mfe/resolver_spec.rb spec/helpers/mfe_helper_spec.rb spec/lib/gitlab/content_security_policy/config_loader_spec.rb
yarn jest spec/frontend/lib/mfe

Live: run a @module-federation/vite dev server for an app, export GITLAB_MFE_DEV_SERVERS, restart rails — the surface renders from the dev server with working HMR.

Stack

#	Scope	MR
1	Config section + instance kill switch	!246732 (merged)
2	Vendor pin file + registry manifest schema + verified bake task	!246736 (closed)
3	Version overrides table + resolver	!246753 (closed)
4	Admin API + routes + sidebar	!246758 (closed)
5	Admin UI (Vue)	!246764 (closed)
6a	Runtime loader: gon contract, manifest verification + SRI, baked fallback, CSP connect-src	!246775 (closed)
6b	Duo Chat consumer behind mfe_duo_chat	!246778 (closed)
7	Developer mode (local dev server + HMR)	this MR

Related

• Phase 1 issue: #605798
• Epic: gitlab-org#22777

Related to #605798.