Phase 2: LTI plumbing, roster sync, and fake-launch dev mode

OIDC login, launch, and JWKS endpoints built on pylti1p3next's Flask
adapter, with launch-claim processing split into a testable module.
Instructor launches refresh the roster through NRPS; the sync code is
source-agnostic and also drives the dev-mode fake roster. Dev mode
(COLDCALL_DEV_MODE=1) provides fake instructor and student personas
that set up the same session state as a real launch, so the rest of
the app can be developed before a Canvas Developer Key exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_app.py

@@ -0,0 +1,58 @@
+import pytest
+
+from coldcall_lti import create_app
+from coldcall_lti.config import Config
+from coldcall_lti.db import Base
+
+
+def make_app(tmp_path, dev_mode):
+    class TestConfig(Config):
+        TESTING = True
+        DATABASE_URL = f"sqlite:///{tmp_path}/test.sqlite3"
+        DEV_MODE = dev_mode
+        SECRET_KEY = "test"
+
+    app = create_app(TestConfig)
+    Base.metadata.create_all(app.extensions["db_engine"])
+    return app
+
+
+@pytest.fixture
+def dev_client(tmp_path):
+    return make_app(tmp_path, dev_mode=True).test_client()
+
+
+def test_healthz(tmp_path):
+    client = make_app(tmp_path, dev_mode=False).test_client()
+    assert client.get("/healthz").json == {"status": "ok"}
+
+
+def test_dev_routes_absent_outside_dev_mode(tmp_path):
+    client = make_app(tmp_path, dev_mode=False).test_client()
+    assert client.get("/dev/").status_code == 404
+
+
+def test_views_require_launch(dev_client):
+    assert dev_client.get("/instructor").status_code == 403
+    assert dev_client.get("/me").status_code == 403
+
+
+def test_dev_instructor_launch_shows_roster(dev_client):
+    assert dev_client.get("/dev/").status_code == 200
+    resp = dev_client.post(
+        "/dev/launch/dev-instructor", follow_redirects=True
+    )
+    assert resp.status_code == 200
+    page = resp.get_data(as_text=True)
+    assert "8 active students" in page
+    assert "Ada Lovelace" in page
+
+
+def test_dev_student_launch(dev_client):
+    resp = dev_client.post(
+        "/dev/launch/dev-student-1", follow_redirects=True
+    )
+    page = resp.get_data(as_text=True)
+    assert "Ada Lovelace" in page
+    # A student cannot reach the instructor view.
+    assert dev_client.get("/instructor").status_code == 403