Generate cfg/dev.yaml via a Make target

Committing a fully-materialised cfg/dev.yaml hid the dev
configuration surface and blocked the OAuth2 signing-key inlining
change: the new config requires a per-dev private key that must
not be committed. Replace the checked-in file with a dev-config
Make target that shells out to probod-bootstrap with dev-safe
defaults and a stable RSA signing key stashed under
cfg/.dev-oauth2-signing-key.pem on first run.

The recipe sources cfg/dev.env when present so devs can override
any setting without editing the Makefile; cfg/dev.env.example
ships the full list of overridable knobs. cfg/dev.yaml,
cfg/dev.env, and the signing key are all gitignored.

Update README, CONTRIBUTING, and contrib/claude/config.md to
describe the new workflow.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

README.md

@@ -48,6 +48,9 @@ Probo is designed to be accessible, transparent, and community-driven.
    # Build the project
    make build
 
+   # Generate the local dev config (writes cfg/dev.yaml)
+   make dev-config
+
    # Start the application using development settings
    bin/probod -cfg-file cfg/dev.yaml
    ```
@@ -65,7 +68,7 @@ To test the custom domains feature locally, add the CNAME target to your hosts f
 127.0.0.1 custom.getprobo.com
 ```
 
-This allows you to test custom trust center domains on your local machine. The CNAME target can be configured in `cfg/dev.yaml` under `custom-domains.cname-target`.
+This allows you to test custom trust center domains on your local machine. The generated `cfg/dev.yaml` sets the CNAME target via `custom-domains.cname-target`; change `CUSTOM_DOMAINS_CNAME_TARGET` before running `make dev-config` to override it.
 
 For detailed setup instructions, see our [Contributing Guide](CONTRIBUTING.md).