Add pre-issued DNLA TAN test flow

[UmerkhanGolandaz]

What changed

• Add a server-only pool for pre-issued DNLA test TANs.
• Atomically reserve one TAN per candidate without calling tan/create.
• Launch DNLA through the current working https://next.dnla.com/?tan=... login route.
• Expose test availability to the DNLA client and add focused test-mode UI.
• Document test-only environment variables and add unit coverage.

Why

The old /start?tan=... link loads a spinner because /start expects an authenticated DNLA session. The current frontend reads TANs on /, validates them, and authenticates before navigating to /start.

Validation

• Focused TAN tests: 3 passed.
• TypeScript check passed.
• Next.js production build passed.
• Local API flow passed: availability, reservation, pending status, and idempotent repeat.
• Provider check: the first three supplied TANs report first_login_ok; the remaining two were not consumed and need browser confirmation.

Test activation

Configure DNLA_TEST_TANS as a server-only secret in the test deployment. Result retrieval still requires DNLA_API_KEY, DNLA_WEBHOOK_SECRET, and the DNLA completion webhook.