feat(features): add bind-dev-seed binders for auth/marketing-pages/navigation/media

Mirrors the canonical blog pattern landed earlier on this branch.

Per feature:
- src/__seeds__/dev.ts — lazy buildDev<Entities>() function using the
  feature's existing factory for sensible defaults
- src/di/bind-dev-seed.ts — bindDevSeed<Feature>() async function that
  rebinds the repo symbol(s) to a populated MockXRepository via
  .toConstantValue
- src/di/bind-dev-seed.test.ts — 3+ tests per feature (populates,
  reachable by id/slug, idempotent)
- package.json — adds ./di/bind-dev-seed subpath export

Tests + use cases continue to construct mocks directly; the seed never
runs from a *.test.ts path. App boot wiring (USE_DEV_SEED env branch)
follows in a separate commit.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/package.json

@@ -8,7 +8,8 @@
     "./ui": "./src/ui/index.ts",
     "./cms": "./src/integrations/cms/index.ts",
     "./api": "./src/integrations/api/router.ts",
-    "./di/bind-production": "./src/di/bind-production.ts"
+    "./di/bind-production": "./src/di/bind-production.ts",
+    "./di/bind-dev-seed": "./src/di/bind-dev-seed.ts"
   },
   "scripts": {
     "build": "tsc --noEmit",

packages/auth/src/__seeds__/dev.ts

@@ -0,0 +1,27 @@
+import { userFactory } from "../__factories__/user.factory.js";
+import type { User } from "../entities/models/user.js";
+
+/**
+ * Realistic auth seed for dev mode + storybook stories.
+ *
+ * Built from `userFactory` so factory defaults take care of boring fields
+ * and we only override what makes the data look like a real user database.
+ *
+ * Lazily produced so importing this module is side-effect-free — the
+ * factory's sequence counter only advances when a binder calls
+ * `buildDevUsers()`.
+ */
+export function buildDevUsers(): User[] {
+  return [
+    userFactory.build({
+      id: "alice",
+      username: "alice",
+      passwordHash: "hashed_secret_alice",
+    }),
+    userFactory.build({
+      id: "bob",
+      username: "bob",
+      passwordHash: "hashed_secret_bob",
+    }),
+  ];
+}

packages/auth/src/di/bind-dev-seed.test.ts

@@ -0,0 +1,73 @@
+import "reflect-metadata";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { bindDevSeedAuth } from "@/di/bind-dev-seed";
+import { authContainer } from "@/di/container";
+import { AUTH_SYMBOLS } from "@/di/symbols";
+import { MockUsersRepository } from "@/infrastructure/repositories/users.repository.mock";
+import type { IUsersRepository } from "@/application/repositories/users.repository.interface";
+
+describe("bindDevSeedAuth", () => {
+  // Each test starts from the default empty-mock binding and tears down
+  // afterwards so the global authContainer state stays clean for siblings.
+  beforeEach(() => {
+    if (authContainer.isBound(AUTH_SYMBOLS.IUsersRepository)) {
+      authContainer.unbind(AUTH_SYMBOLS.IUsersRepository);
+    }
+    authContainer
+      .bind<IUsersRepository>(AUTH_SYMBOLS.IUsersRepository)
+      .to(MockUsersRepository);
+  });
+
+  afterEach(() => {
+    if (authContainer.isBound(AUTH_SYMBOLS.IUsersRepository)) {
+      authContainer.unbind(AUTH_SYMBOLS.IUsersRepository);
+    }
+    authContainer
+      .bind<IUsersRepository>(AUTH_SYMBOLS.IUsersRepository)
+      .to(MockUsersRepository);
+  });
+
+  it("populates the repository with the dev users", async () => {
+    await bindDevSeedAuth();
+
+    const repo = authContainer.get<IUsersRepository>(
+      AUTH_SYMBOLS.IUsersRepository,
+    );
+    const alice = await repo.getUserByUsername("alice");
+    const bob = await repo.getUserByUsername("bob");
+
+    expect(alice).toBeDefined();
+    expect(bob).toBeDefined();
+  });
+
+  it("seeds alice reachable by username", async () => {
+    await bindDevSeedAuth();
+
+    const repo = authContainer.get<IUsersRepository>(
+      AUTH_SYMBOLS.IUsersRepository,
+    );
+    const alice = await repo.getUserByUsername("alice");
+
+    expect(alice).toBeDefined();
+    expect(alice?.id).toBe("alice");
+    expect(alice?.passwordHash).toBe("hashed_secret_alice");
+  });
+
+  it("is idempotent — calling twice rebuilds a fresh populated repo", async () => {
+    await bindDevSeedAuth();
+    const before = authContainer.get<IUsersRepository>(
+      AUTH_SYMBOLS.IUsersRepository,
+    );
+    const beforeAlice = await before.getUserByUsername("alice");
+
+    await bindDevSeedAuth();
+    const after = authContainer.get<IUsersRepository>(
+      AUTH_SYMBOLS.IUsersRepository,
+    );
+    const afterAlice = await after.getUserByUsername("alice");
+
+    expect(afterAlice?.username).toBe(beforeAlice?.username);
+    // It's a fresh instance — not the previous one.
+    expect(after).not.toBe(before);
+  });
+});

packages/auth/src/di/bind-dev-seed.ts

@@ -0,0 +1,33 @@
+import { authContainer } from "./container.js";
+import { AUTH_SYMBOLS } from "./symbols.js";
+import { MockUsersRepository } from "../infrastructure/repositories/users.repository.mock.js";
+import { buildDevUsers } from "../__seeds__/dev.js";
+import type { IUsersRepository } from "../application/repositories/users.repository.interface.js";
+
+/**
+ * Replace the default mock with a populated one for dev mode + storybook.
+ *
+ * Call this from app boot when `USE_DEV_SEED=true`, mutually exclusive with
+ * `bindProductionAuth(config)`. Tests must NOT call this — they construct
+ * `new MockUsersRepository()` directly and seed via factories per-test.
+ *
+ * The `IAuthenticationService` binding is left untouched; it resolves users
+ * through DI from the newly seeded repo.
+ *
+ * Idempotent: safe to call multiple times; each call rebuilds a fresh
+ * populated repo and rebinds the symbol.
+ */
+export async function bindDevSeedAuth(): Promise<void> {
+  if (authContainer.isBound(AUTH_SYMBOLS.IUsersRepository)) {
+    authContainer.unbind(AUTH_SYMBOLS.IUsersRepository);
+  }
+
+  const repo = new MockUsersRepository([]);
+  for (const user of buildDevUsers()) {
+    await repo.createUser(user);
+  }
+
+  authContainer
+    .bind<IUsersRepository>(AUTH_SYMBOLS.IUsersRepository)
+    .toConstantValue(repo);
+}