feat(dev): switch dev tokens to a real admin account with configurable duration

Requested: dev-token.sh/.ps1 tokens should last 3h by default, with an
argument to override the duration.

Server-verified finding: STALWART_RECOVERY_ADMIN (the break-glass
account docker-compose.yml and the scripts used) always issues OAuth
tokens with a fixed 1h expiry, regardless of the server's configured
accessTokenExpiry — confirmed against the live container, including
after changing the setting and restarting. Confirmed x:ApiKey objects,
by contrast, support an arbitrary expiresAt set per request, and their
secret works directly as a bearer token.

Add scripts/dev-server-init.sh (+ .ps1): a one-time, idempotent setup
step that completes the server's bootstrap wizard (default domain, no
TLS certificate request), creates a real "devadmin" admin account, and
sets the server's default OAuth token lifetime to 3h.

Rework dev-token.sh/.ps1 to authenticate as devadmin and create an
x:ApiKey with a caller-supplied expiry (`dev-token.sh 1800` for 30
minutes, defaults to 10800s/3h) instead of running the OAuth PKCE flow
against the recovery account. Verified end-to-end against a fresh
container, including a real browser session against the running WebUI.

Also includes an incidental package-lock.json sync (was still pinned to
v1.0.8 / stale dependency ranges from before the upstream merge).

docker-compose.yml

@@ -22,7 +22,9 @@ services:
       - stalwart-data:/var/lib/stalwart
     environment:
       # Disposable local dev credentials — do not reuse for anything real.
-      # Matches scripts/dev-token.ps1's defaults.
+      # Break-glass admin, used only by scripts/dev-server-init.sh (its
+      # tokens always expire in 1h regardless of server config, so it's
+      # not used for day-to-day dev tokens — see scripts/dev-token.sh).
       STALWART_RECOVERY_ADMIN: "admin@example.org:c8321iEscHDy0GWV"
 
 volumes: