Restructure docker into layered compose files, add a Makefile

Move compose.yml/compose.override.yml/compose.traefik.yml into docker/ and
split into the explicit prod -> dev -> local layering; compose.override.yml
had to be renamed because docker compose auto-loads that filename, which
defeats the layering.

- external network traefik-public -> proxy (shared with the website stack)
- frontend host dashboard.${DOMAIN} -> app.${DOMAIN}
- stable container_names, security_opt no-new-privileges on prod services
- adminer bound to 127.0.0.1 in dev instead of all interfaces
- .env.example replaces the committed .env
- pre-commit biome hook ran npm in a bun repo

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker/compose.local.yml

@@ -0,0 +1,33 @@
+# Integrated local stack — layered on top of compose.yml + compose.dev.yml by
+# the root `make dev`. Reattaches this stack's Traefik to the shared external
+# `proxy` network so it also routes the website stack's containers, and serves
+# everything over plain http on *.${DOMAIN} (default *.localhost).
+
+services:
+
+  proxy:
+    networks:
+      - proxy
+      - default
+
+  backend:
+    environment:
+      - ENVIRONMENT=local
+      - FRONTEND_HOST=http://app.${DOMAIN:-localhost}
+      - BACKEND_CORS_ORIGINS=http://${DOMAIN:-localhost},http://app.${DOMAIN:-localhost}
+
+  prestart:
+    environment:
+      - ENVIRONMENT=local
+      - FRONTEND_HOST=http://app.${DOMAIN:-localhost}
+
+  frontend:
+    build:
+      args:
+        - VITE_API_URL=http://api.${DOMAIN:-localhost}
+        - NODE_ENV=development
+
+networks:
+  # Shared with the website stack; created by the root scripts/setup.sh.
+  proxy:
+    external: true