feat(decnet_web/theme-lab): scaffold dev-gated /theme-lab route

Adds VITE_DECNET_DEVELOPER build-time gate: when unset, the
isDeveloperMode() helper collapses to a constant false and Vite
tree-shakes both the lazy import and the conditional <Route> out
of the prod bundle.

ThemeLab is currently a header stub; subsequent tasks fill it
with the design-system primitive zoo plus a Dark/Light toggle
for live token tuning. Route is intentionally absent from
ROUTE_LABELS / sidebar — direct URL only.

decnet_web/src/lib/__tests__/devGate.test.ts

@@ -0,0 +1,36 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+describe('devGate.isDeveloperMode', () => {
+  const originalEnv = { ...import.meta.env };
+
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    // Restore the env keys we touched so other tests aren't perturbed.
+    (import.meta.env as Record<string, unknown>).VITE_DECNET_DEVELOPER =
+      originalEnv.VITE_DECNET_DEVELOPER;
+  });
+
+  it('returns true when VITE_DECNET_DEVELOPER === "1"', async () => {
+    (import.meta.env as Record<string, unknown>).VITE_DECNET_DEVELOPER = '1';
+    const { isDeveloperMode } = await import('../devGate');
+    expect(isDeveloperMode()).toBe(true);
+  });
+
+  it('returns false when VITE_DECNET_DEVELOPER is undefined', async () => {
+    delete (import.meta.env as Record<string, unknown>).VITE_DECNET_DEVELOPER;
+    const { isDeveloperMode } = await import('../devGate');
+    expect(isDeveloperMode()).toBe(false);
+  });
+
+  it('returns false for any value other than "1"', async () => {
+    for (const v of ['0', 'true', '', 'yes']) {
+      (import.meta.env as Record<string, unknown>).VITE_DECNET_DEVELOPER = v;
+      vi.resetModules();
+      const { isDeveloperMode } = await import('../devGate');
+      expect(isDeveloperMode()).toBe(false);
+    }
+  });
+});

decnet_web/src/lib/devGate.ts

@@ -0,0 +1,12 @@
+/* Dev-only feature gate.
+ *
+ * Reads VITE_DECNET_DEVELOPER at build time. Vite inlines the value
+ * at compile, so a prod build with the flag unset becomes a constant
+ * `false` and the route guard plus its lazy import are tree-shaken
+ * out of the bundle entirely.
+ *
+ * Set in .env.development:  VITE_DECNET_DEVELOPER=1
+ */
+export function isDeveloperMode(): boolean {
+  return import.meta.env.VITE_DECNET_DEVELOPER === '1';
+}