fix(dev): DevPlugin derives org roles from its stack too (#3723)

The fourth host that boots AuthPlugin from a loaded stack, and the last one
still walking past `additionalOrgRoles`. Unlike the pre-fix `serve` path this
was not a mismatch — passing nothing left better-auth and the selects agreeing
on the built-ins — but DevPlugin documents itself as equivalent to assembling
the full stack by hand, and that equivalence quietly excluded every
app-declared organization role.

Now uses the same `collectStackOrgRoles(this.options.stack)` as `serve` and the
verify harness. Guarded on the export being present: plugin-auth is a dynamic
optional import here, so an older copy on disk yields none rather than throwing.

Author: claude

packages/plugins/plugin-dev/src/dev-plugin.ts

@@ -522,10 +522,21 @@ export class DevPlugin implements Plugin {
     let authMounted = false;
     if (enabled('auth')) {
       try {
-        const { AuthPlugin } = await import('@objectstack/plugin-auth') as any;
+        const { AuthPlugin, collectStackOrgRoles } = await import('@objectstack/plugin-auth') as any;
+        // [#3723] The same stack walk `objectstack serve` and the verify
+        // harness use. DevPlugin advertises itself as equivalent to the full
+        // stack, so a stack whose declared positions / permission sets are
+        // invitable under `serve` must be invitable here too — otherwise
+        // "equivalent" quietly excludes app-declared organization roles.
+        // Guarded: an older plugin-auth on disk simply yields none.
+        const additionalOrgRoles: string[] =
+          typeof collectStackOrgRoles === 'function'
+            ? collectStackOrgRoles(this.options.stack, ctx.logger)
+            : [];
         const authPlugin = new AuthPlugin({
           secret: this.options.authSecret,
           baseUrl: this.options.authBaseUrl,
+          ...(additionalOrgRoles.length > 0 ? { additionalOrgRoles } : {}),
         });
         this.childPlugins.push(authPlugin);
         authMounted = true;