Restructure docker into layered compose files, add a Makefile

Move compose.yml/compose.override.yml/compose.traefik.yml into docker/ and
split into the explicit prod -> dev -> local layering; compose.override.yml
had to be renamed because docker compose auto-loads that filename, which
defeats the layering.

- external network traefik-public -> proxy (shared with the website stack)
- frontend host dashboard.${DOMAIN} -> app.${DOMAIN}
- stable container_names, security_opt no-new-privileges on prod services
- adminer bound to 127.0.0.1 in dev instead of all interfaces
- .env.example replaces the committed .env
- pre-commit biome hook ran npm in a bun repo

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker/compose.dev.yml

@@ -0,0 +1,123 @@
+# Local development overrides: a self-contained stack with its own Traefik,
+# published host ports, hot reload and the mail/browser test helpers.
+# Never used in production — the Makefile only layers it for `make dev*`.
+
+services:
+
+  # Local Traefik. Services stay reachable both on their published ports and
+  # on http://api.localhost / http://app.localhost via the routers in
+  # compose.yml. Dashboard at http://localhost:8090.
+  proxy:
+    image: traefik:3.6
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    ports:
+      - "80:80"
+      - "8090:8080"
+    command:
+      - --providers.docker
+      - --providers.docker.constraints=Label(`traefik.constraint-label`, `proxy`)
+      - --providers.docker.exposedbydefault=false
+      - --entrypoints.http.address=:80
+      - --entrypoints.https.address=:443
+      - --accesslog
+      - --log
+      - --log.level=DEBUG
+      - --api
+      - --api.insecure=true
+    labels:
+      - traefik.enable=true
+      - traefik.constraint-label=proxy
+      # Dummy https-redirect middleware that doesn't really redirect, so the
+      # production routers' middleware reference still resolves locally.
+      - traefik.http.middlewares.https-redirect.contenttype.autodetect=false
+    networks:
+      - proxy
+      - default
+
+  db:
+    restart: "no"
+    ports:
+      - "5432:5432"
+
+  adminer:
+    restart: "no"
+    ports:
+      - "127.0.0.1:8080:8080"
+
+  backend:
+    restart: "no"
+    ports:
+      - "8000:8000"
+    build:
+      context: ..
+      dockerfile: backend/Dockerfile
+    command:
+      - fastapi
+      - run
+      - --reload
+      - "app/main.py"
+    develop:
+      watch:
+        - path: ../backend
+          action: sync
+          target: /app/backend
+          ignore:
+            - ../backend/.venv
+            - .venv
+        - path: ../backend/pyproject.toml
+          action: rebuild
+    volumes:
+      - ../backend/htmlcov:/app/backend/htmlcov
+    environment:
+      SMTP_HOST: "mailcatcher"
+      SMTP_PORT: "1025"
+      SMTP_TLS: "false"
+      EMAILS_FROM_EMAIL: "noreply@fluksio.com"
+
+  mailcatcher:
+    image: schickling/mailcatcher
+    ports:
+      - "1080:1080"
+      - "1025:1025"
+
+  frontend:
+    restart: "no"
+    ports:
+      - "5173:80"
+    build:
+      context: ..
+      dockerfile: frontend/Dockerfile
+      args:
+        - VITE_API_URL=http://localhost:8000
+        - NODE_ENV=development
+
+  playwright:
+    build:
+      context: ..
+      dockerfile: frontend/Dockerfile.playwright
+      args:
+        - VITE_API_URL=http://backend:8000
+        - NODE_ENV=production
+    ipc: host
+    depends_on:
+      - backend
+      - mailcatcher
+    env_file:
+      - ../.env
+    environment:
+      - VITE_API_URL=http://backend:8000
+      - MAILCATCHER_HOST=http://mailcatcher:1080
+      - PLAYWRIGHT_HTML_HOST=0.0.0.0
+      - CI=${CI}
+    volumes:
+      - ../frontend/blob-report:/app/frontend/blob-report
+      - ../frontend/test-results:/app/frontend/test-results
+    ports:
+      - 9323:9323
+
+networks:
+  # Self-contained dev: create a stack-local network instead of expecting the
+  # shared one. compose.local.yml flips this back for the integrated stack.
+  proxy:
+    external: false