Phase 2: LTI plumbing, roster sync, and fake-launch dev mode

OIDC login, launch, and JWKS endpoints built on pylti1p3next's Flask
adapter, with launch-claim processing split into a testable module.
Instructor launches refresh the roster through NRPS; the sync code is
source-agnostic and also drives the dev-mode fake roster. Dev mode
(COLDCALL_DEV_MODE=1) provides fake instructor and student personas
that set up the same session state as a real launch, so the rest of
the app can be developed before a Canvas Developer Key exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lti_config.example.json

@@ -0,0 +1,14 @@
+{
+  "https://canvas.instructure.com": [
+    {
+      "default": true,
+      "client_id": "FIXME-developer-key-client-id",
+      "auth_login_url": "https://sso.canvaslms.com/api/lti/authorize_redirect",
+      "auth_token_url": "https://sso.canvaslms.com/login/oauth2/token",
+      "key_set_url": "https://sso.canvaslms.com/api/lti/security/jwks",
+      "private_key_file": "private.key",
+      "public_key_file": "public.key",
+      "deployment_ids": ["FIXME-deployment-id"]
+    }
+  ]
+}