fix(api-gateway): 修复尾斜杠重定向循环与 DEV_MODE 旁路

- main.go: 禁用 RedirectTrailingSlash，为 classes/iam/teacher 双注册无尾斜杠与通配符路由

- auth.go: DEV_MODE=true 时接受 Bearer dev-token 注入开发用户

- config.go: 新增 DevMode 配置项与 getEnvBool 工具

- page.tsx: 开发模式请求携带 Authorization: Bearer dev-token

- .env.example: 添加 DEV_MODE=false 默认值与生产警告

services/api-gateway/internal/config/config.go

@@ -15,6 +15,7 @@ type Config struct {
 	TeacherBffURL     string
 	OTLPEndpoint      string
 	LogLevel          string
+	DevMode           bool
 }
 
 func Load() *Config {
@@ -28,6 +29,7 @@ func Load() *Config {
 		TeacherBffURL:     getEnv("TEACHER_BFF_URL", "http://localhost:3003"),
 		OTLPEndpoint:      getEnv("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4318"),
 		LogLevel:          getEnv("LOG_LEVEL", "info"),
+		DevMode:           getEnvBool("DEV_MODE", false),
 	}
 }
 
@@ -46,3 +48,12 @@ func getEnvInt(key string, fallback int) int {
 	}
 	return fallback
 }
+
+func getEnvBool(key string, fallback bool) bool {
+	if v := os.Getenv(key); v != "" {
+		if b, err := strconv.ParseBool(v); err == nil {
+			return b
+		}
+	}
+	return fallback
+}

services/api-gateway/internal/middleware/auth.go

@@ -1,4 +1,4 @@
-package middleware
+package middleware
 
 import (
 	"net/http"
@@ -44,6 +44,15 @@ func AuthMiddleware(cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
+		// 开发模式旁路：DEV_MODE=true 时接受 "dev-token"，注入开发用户
+		// 仅用于本地联调，生产环境必须关闭 DEV_MODE
+		if cfg.DevMode && tokenStr == "dev-token" {
+			c.Request.Header.Set("x-user-id", "dev-user")
+			c.Request.Header.Set("x-user-roles", "teacher,admin")
+			c.Next()
+			return
+		}
+
 		token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
 			if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
 				return nil, jwt.ErrSignatureInvalid