fix(access): dev unlock defaults OFF

ACCESS_DEV_UNLOCK was opt-out (anything but 'false' enabled it) and
access.example.json shipped it on, so a gated production machine would
render a visible gate-bypass button on the lock screen by default. Flip
to opt-in (=== 'true'), update the example file and the provisioning
schema comment to match.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/nixos/access.example.json

@@ -1,5 +1,5 @@
 {
   "enabled": true,
   "openEnrollment": true,
-  "devUnlock": true
+  "devUnlock": false
 }