local-dev: parameterize host-port mappings via LOCAL_DEV_*_PORT

The compose stack hard-coded host ports (postgres 5433, redis 6380,
mailpit 8025, gateway REST 8080, gateway gRPC 9090) — fine for a
clean dev machine, painful when those ports collide with other
services on the same host (e.g. a `crowdsec` sitting on
127.0.0.1:8080 or a Prometheus instance on :9090).

Every host-port mapping is now `${LOCAL_DEV_*_PORT:-<old-default>}`,
so the defaults match prior behaviour for everyone and a per-host
override is a single environment variable away. `.env` carries the
overrides as commented-out lines so the customisation surface is
discoverable without grepping the compose file. README's
"Port 8080 already in use" troubleshooting entry now points at the
new variables and the optional `docker-compose.override.yml`
workflow.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tools/local-dev/docker-compose.yml

@@ -29,7 +29,7 @@ services:
       POSTGRES_PASSWORD: galaxy
       POSTGRES_DB: galaxy_backend
     ports:
-      - "5433:5432"
+      - "${LOCAL_DEV_POSTGRES_PORT:-5433}:5432"
     volumes:
       - postgres-data:/var/lib/postgresql/data
     networks:
@@ -54,7 +54,7 @@ services:
       - --save
       - ""
     ports:
-      - "6380:6379"
+      - "${LOCAL_DEV_REDIS_PORT:-6380}:6379"
     networks:
       - galaxy-net
     healthcheck:
@@ -69,7 +69,7 @@ services:
     container_name: galaxy-local-dev-mailpit
     restart: unless-stopped
     ports:
-      - "8025:8025"
+      - "${LOCAL_DEV_MAILPIT_PORT:-8025}:8025"
     networks:
       - galaxy-net
     healthcheck:
@@ -186,11 +186,11 @@ services:
       GATEWAY_AUTHENTICATED_GRPC_ANTI_ABUSE_MESSAGE_CLASS_RATE_LIMIT_REQUESTS: "10000"
       GATEWAY_AUTHENTICATED_GRPC_ANTI_ABUSE_MESSAGE_CLASS_RATE_LIMIT_BURST: "1000"
     ports:
-      - "8080:8080"
+      - "${LOCAL_DEV_GATEWAY_REST_PORT:-8080}:8080"
       # Authenticated EdgeGateway connect-web/gRPC listener. The
       # browser reaches it via the Vite dev proxy in
       # ui/frontend/vite.config.ts.
-      - "9090:9090"
+      - "${LOCAL_DEV_GATEWAY_GRPC_PORT:-9090}:9090"
     volumes:
       - ./keys/gateway-response.pem:/run/secrets/gateway-response.pem:ro
     networks: