Dev impersonation requires pre-seeded accounts — create unknown names on demand

**Status: enhancement**

## Current behavior
`POST /api/auth/dev/impersonate` (development-only) 404s when the requested `steamName` has no existing `players` row. Local multi-client testing therefore requires a seeding step first (e.g. `seed-speedrun-players.ts`) before any account can be impersonated.

## Proposal
On a `steamName` miss, create the player row on the fly (ToS pre-accepted so throwaway accounts skip the prompt) and log in as it — making local testing zero-setup: launch two clients, impersonate any two names, play. `playerId` (uuid) misses should still 404, since creating a row for a specific uuid is meaningless. The endpoint is already gated to `NODE_ENV=development`, so production exposure is unchanged.

查找 POST /api/auth/dev/impersonate handler 及其 player lookup，然后检查 seed-speedrun-players.ts 以了解 player fields 和 login behavior。完成的标准是：未知的 steamName 会在预先接受 ToS 的情况下被创建并登录，而缺少 playerId 时仍返回 404；通过 development endpoint 验证这两条路径。

由索引模型根据 Issue 内容生成。