fix(dev): make the stub guard un-bypassable in any build

`vite build --mode stub` loads .env.stub, which sets VITE_STUB_API=1, so the
guard admitted the stub into a production bundle — one that patches fetch and
Date and answers /auth/status with an authenticated admin. No npm script does
this, but the file must not be able to reach a build at all.

`import.meta.env.DEV` is false for `vite build` under every mode, so the stub
now cannot ship. Verified: `vite build --mode stub` no longer bundles it, and
the dev server still serves it.

Also bump the stub's fake /health version to match the release.

frontend/src/devStub.ts

@@ -218,7 +218,7 @@ const WIZARD_SSH_TRUST: { trusted: boolean } = { trusted: true }
 const WIZARD_RESET: { ok: boolean } = { ok: true }
 
 const ROUTES: Record<string, unknown> = {
-  'GET /health': { status: 'ok', version: '0.3.0-stub' },
+  'GET /health': { status: 'ok', version: '0.3.1-stub' },
   'GET /auth/status': AUTH_STATUS,
   'GET /auth/me': ME,
   'GET /status': STATUS,

frontend/src/main.tsx

@@ -5,7 +5,10 @@ import './i18n'
 import './index.css'
 import './responsive.css'
 
-if (import.meta.env.VITE_STUB_API === '1') {
+// `import.meta.env.DEV` is false for `vite build` under every mode, so no build can ship the
+// stub — not even `vite build --mode stub`, which would otherwise load `.env.stub` and bundle a
+// module that fakes an authenticated session.
+if (import.meta.env.DEV && import.meta.env.VITE_STUB_API === '1') {
   await import('./devStub')
 }