local-dev: parameterize host-port mappings via LOCAL_DEV_*_PORT

The compose stack hard-coded host ports (postgres 5433, redis 6380,
mailpit 8025, gateway REST 8080, gateway gRPC 9090) — fine for a
clean dev machine, painful when those ports collide with other
services on the same host (e.g. a `crowdsec` sitting on
127.0.0.1:8080 or a Prometheus instance on :9090).

Every host-port mapping is now `${LOCAL_DEV_*_PORT:-<old-default>}`,
so the defaults match prior behaviour for everyone and a per-host
override is a single environment variable away. `.env` carries the
overrides as commented-out lines so the customisation surface is
discoverable without grepping the compose file. README's
"Port 8080 already in use" troubleshooting entry now points at the
new variables and the optional `docker-compose.override.yml`
workflow.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tools/local-dev/.env

@@ -2,6 +2,21 @@
 # file reads these via ${VAR:-} expansions; override per-developer by
 # editing this file (it is committed only with the project defaults).
 
+# Host-port mappings for the stack. The compose file reads each as
+# ${LOCAL_DEV_*_PORT:-<default>}, so leaving them blank or removing
+# the lines below keeps the defaults shown next to each entry. Set
+# a non-default value when the default collides with something else
+# on the host (a system Postgres, a Prometheus instance on :9090,
+# a `crowdsec` sitting on :8080, etc.). The Vite dev server in
+# ui/frontend reads the gateway REST address from
+# VITE_DEV_PROXY_TARGET — point it at the same port (typically via
+# ui/frontend/.env.local).
+#LOCAL_DEV_POSTGRES_PORT=5433
+#LOCAL_DEV_REDIS_PORT=6380
+#LOCAL_DEV_MAILPIT_PORT=8025
+#LOCAL_DEV_GATEWAY_REST_PORT=8080
+#LOCAL_DEV_GATEWAY_GRPC_PORT=9090
+
 # Six-digit decimal accepted by ConfirmEmailCode in addition to the
 # real bcrypt-verified code. Leave the value blank to disable the
 # override and force every login through Mailpit.