M14/SEC-007: gate DEBUG_INJECT_INCOMING_PAIRING behind production mode check

@@ -1152,10 +1152,14 @@11521152         return { ok: true, data: recent };11531153       }11541154       case "DEBUG_INJECT_INCOMING_PAIRING": {1155-        // Manual E2E rehearsal hook. Inserts a synthetic incoming pairing1156-        // request into session storage so Phase 7 banner UX can be exercised1157-        // without a live native host. No Pro gate — this is a no-op in1158-        // production unless explicitly invoked from a Settings debug action.1155+        // M14/SEC-007: blocked in production builds. The handler exists for1156+        // Phase 7 banner UX rehearsal without a live native host; shipping1157+        // it in production lets any background-message sender inject a1158+        // synthetic pairing prompt. Allowed in 'development' and 'test'1159+        // modes; vite sets MODE='production' for release builds.1160+        if (import.meta.env.MODE === "production") {1161+          return { ok: false, error: "not_available" };1162+        }11591163         const { deviceName, publicKeyHex } = (msg.payload ?? {}) as {11601164           deviceName?: string;11611165           publicKeyHex?: string;

@@ -6,5 +6,8 @@66   test: {77     include: ["src/**/*.test.ts", "src/**/*.test.tsx"],88     environment: "node",9+    // M14/SEC-007: tests exercising dev-only handlers10+    // (DEBUG_INJECT_INCOMING_PAIRING) use vi.stubEnv('MODE','development').11+    // Default test MODE is 'test', so the production gate engages by default.912   },1013 });