tools/local-dev: docker-compose stack for UI development

Adds tools/local-dev/ with postgres + redis + mailpit + backend +
gateway plus a Make wrapper, so `make -C tools/local-dev up` brings
the full authenticated stack online and `pnpm -C ui/frontend dev`
talks to it directly. The committed `.env.development` already
points at the stack and pins the matching gateway response public
key from the dev keypair under tools/local-dev/keys/.

The backend ships a new opt-in env, BACKEND_AUTH_DEV_FIXED_CODE
(`tools/local-dev/.env` defaults it to 123456). When set,
ConfirmEmailCode accepts that literal in addition to the real
bcrypt-verified code; SendEmailCode still queues a real email so
Mailpit captures the issued code at http://localhost:8025/, and
both paths coexist. The override is rejected as non-six-digit by
config validation and emits a loud warning at backend startup.

The local-dev Dockerfiles mirror backend/Dockerfile and
gateway/Dockerfile but switch the runtime stage to alpine so
docker-compose healthchecks can wget /healthz; the gateway
Dockerfile additionally copies ui/core/ into the build context
because gateway/go.mod's `replace galaxy/core => ../ui/core` is
required to compile the gateway main.

Smoke tested:
- `make -C tools/local-dev up` boots all five services to healthy.
- send-email-code + confirm-email-code with code=123456 returns a
  device_session_id; a real code in Mailpit also redeems
  successfully.
- `pnpm test` 14/14, `pnpm exec playwright test` 44/44.
- `go test ./backend/internal/config/...` green.

Docs: tools/local-dev/README.md, tools/local-dev/keys/README.md,
new "Local development stack" section in ui/docs/testing.md, and a
short pointer in ui/README.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/frontend/.env.development

@@ -0,0 +1,12 @@
+# Vite picks this file up automatically when running in `development`
+# mode (`pnpm dev`, `pnpm test:e2e`). It targets the local-dev stack
+# brought up by `make -C tools/local-dev up`. Per-developer overrides
+# live in `.env.development.local` (gitignored by Vite convention).
+
+# Gateway public REST + Connect-Web edge listener.
+VITE_GATEWAY_BASE_URL=http://localhost:8080
+
+# Standard non-URL-safe base64 of the gateway response-signing public
+# key. Pairs with `tools/local-dev/keys/gateway-response.pem`. The pair
+# is dev-only — see `tools/local-dev/keys/README.md` before rotating.
+VITE_GATEWAY_RESPONSE_PUBLIC_KEY=nIG54tCuNiIKrazt8Hh7YxmmU/BhpseGhIIgj164Chw=

ui/frontend/.env.example

@@ -1,18 +1,17 @@
 # Vite reads any variable prefixed with `VITE_` and exposes it on
-# `import.meta.env`. Copy this file to `.env.local` (gitignored) and
-# fill in the values before running `pnpm run dev` or `pnpm exec
-# playwright test` against a real gateway.
+# `import.meta.env`. The committed `.env.development` already targets
+# the `tools/local-dev/` docker stack — most contributors don't need
+# to copy this file. Use a `.env.development.local` (gitignored by
+# Vite convention) for per-developer overrides, or use `.env.local`
+# when running `pnpm exec playwright test` against a non-default
+# gateway.
 
 # Base URL of the gateway public REST surface and Connect-Web edge
-# listener. Both surfaces share the same host and port. Defaults to
-# the local dev address used by `tools/local-ci` and the Go-side
-# integration suite.
+# listener. Both surfaces share the same host and port.
 VITE_GATEWAY_BASE_URL=http://localhost:8080
 
 # Standard (non-URL-safe) base64 of the gateway's raw 32-byte
-# Ed25519 response-signing public key. Required only for
-# authenticated unary calls; unauthenticated routes (`/login`)
-# work without it. For local dev, take the value the gateway
-# integration container exports as `ResponseSignerPublic` (see
-# `integration/testenv/gateway.go`).
+# Ed25519 response-signing public key. The local-dev stack ships a
+# checked-in keypair under `tools/local-dev/keys/`; for any other
+# environment, take the value from the gateway operator.
 VITE_GATEWAY_RESPONSE_PUBLIC_KEY=