dev: document server-only pieces (authorizer + frps.toml)

Add dev/SERVER-ONLY.md (extended check-subdomain authorizer code + dev frps
notes) and dev/frps/frps.toml.example (sanitized template) so the gitignored,
server-only parts of the dev setup are reproducible from the repo.

dev/frps/frps.toml.example

@@ -0,0 +1,23 @@
+# Dev frps server config — TEMPLATE (no secrets).
+#
+# The live file is `frps.toml` (gitignored) and is identical to this except
+# `webServer.password` holds the real dev frps dashboard password.
+# Copy this to frps.toml and fill the password before first start.
+
+bindPort = 7001
+vhostHTTPPort = 7080
+log.level = "info"
+log.maxDays = 7
+
+webServer.addr = "0.0.0.0"
+webServer.port = 7500
+webServer.user = "admin"
+webServer.password = "__SET_DEV_FRPS_DASHBOARD_PASSWORD__"
+
+# Tunnel auth/lifecycle is delegated to the dev edge function (same design as
+# prod): frps calls the auth-webhook on Login / NewProxy / Ping.
+[[httpPlugins]]
+name = "auth"
+addr = "http://supabase-dev-edge-functions:9000"
+path = "/auth-webhook"
+ops = ["Login", "NewProxy", "Ping"]