chore(dev): add pnpm dev hot-reload workflow for local development

Replace full docker compose rebuild during development with:
- pnpm dev / dev:backend (air hot-reload control-plane) / dev:frontend (vite HMR) / dev:deps
- compose.dev.yaml: postgres+docker-gateway only, host port mapping (5432/8081), container control-plane disabled via profile
- scripts/dev-backend.mjs: read .env, fill dev defaults (login admin/admin123, listen :8082, 32-byte dev master key with explicit warning on invalid .env value), ensure dep containers, run air
- vite: fixed port 5173, /api proxy to local control-plane (8082)
- README: document hot-reload dev workflow

Verified: pnpm dev end-to-end (login/API/frontend/proxy 200), Go+JSX edit hot-reload, compose config --quiet, go build ./..., web tests 65 passed, npm --prefix web run build.

web/vite.config.js

@@ -1,21 +1,23 @@
-import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
-import tailwindcss from '@tailwindcss/vite'
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import tailwindcss from "@tailwindcss/vite";
 
 export default defineConfig({
   plugins: [react(), tailwindcss()],
   server: {
-    proxy: { '/api': 'http://127.0.0.1:8080' },
+    port: 5173,
+    strictPort: true,
+    proxy: { "/api": "http://127.0.0.1:8082" },
   },
   test: {
-    environment: 'jsdom',
-    pool: 'threads',
+    environment: "jsdom",
+    pool: "threads",
     maxWorkers: 1,
     isolate: false, // ponytail: one worker avoids 90s startup stalls; restore isolation if tests leak state.
     coverage: {
-      provider: 'v8',
-      reporter: ['text'],
+      provider: "v8",
+      reporter: ["text"],
       thresholds: { lines: 65 },
     },
   },
-})
+});