added prototype dev settings with test import and db wipe

handlers/dev.php

@@ -0,0 +1,57 @@
+<?php
+/**
+ * Admin-only dev fixture import (local / test environments).
+ */
+
+require_once __DIR__ . '/../lib/dev_fixture.php';
+
+$tokenRec = require_valid_token_web();
+require_role(['admin'], $tokenRec);
+
+if ($method !== 'POST') {
+    json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
+}
+
+$body = read_json_body();
+$action = trim((string)($body['action'] ?? 'import'));
+
+try {
+    [$pdo, $tmpDb, $lockFp] = qdb_open(true);
+
+    if ($action === 'remove') {
+        $result = qdb_remove_dev_test_data($pdo, [
+            'usernamePrefix'  => $body['usernamePrefix'] ?? 'dev_',
+            'clientCodePrefix' => $body['clientCodePrefix'] ?? 'DEV-CL-',
+        ]);
+        qdb_save($tmpDb, $lockFp);
+        json_success($result);
+    }
+
+    if ($action === 'wipeExceptAdmins') {
+        $result = qdb_wipe_all_data_except_admins($pdo);
+        qdb_save($tmpDb, $lockFp);
+        json_success($result);
+    }
+
+    $fixture = $body['fixture'] ?? null;
+    if (!is_array($fixture)) {
+        qdb_discard($tmpDb, $lockFp);
+        json_error('MISSING_FIELDS', 'fixture object is required for import', 400);
+    }
+
+    $result = qdb_import_dev_fixture($pdo, $fixture);
+    qdb_save($tmpDb, $lockFp);
+    json_success($result);
+} catch (Throwable $e) {
+    if (isset($tmpDb, $lockFp)) {
+        qdb_discard($tmpDb, $lockFp);
+    }
+    $labels = [
+        'remove'           => 'Remove',
+        'wipeExceptAdmins' => 'Wipe',
+        'import'           => 'Import',
+    ];
+    $label = $labels[$action ?? 'import'] ?? 'Operation';
+    error_log("dev fixture $label: " . $e->getMessage());
+    json_error('SERVER_ERROR', "$label failed: " . $e->getMessage(), 500);
+}