feat: add full dev stack (Gitea, code-server, registry, DBX, Vault, BookStack, Plane)

- dev-compose.yml: 16-service dev stack on dedicated devstack network
- vault.hcl: Vault file-backend config; Vault initialized and unsealed
- docker-compose.yml: add devstack as external network on caddy
- Caddyfile: LAN-only site blocks for all 7 dev services; Plane routed
  via Caddy path handles (no bundled proxy container)
- apply-compose.ps1: add -DevStack and -VaultUnseal flags
- .env: dev stack secrets + all 5 Vault unseal keys + root token

Dev URLs (LAN-only): gitea, code, registry, dbx, vault, docs, plane
Stack managed by Portainer as dev-stack (id 7)

.env

@@ -106,3 +106,33 @@ CF_API_TOKEN=cfut_ijIT9HDjXWKgd0dtnyLqxv8L3deB7hSDivSqquwp905a6c51
 
 # GitHub Actions self-hosted runner (fine-grained PAT, Administration:write on homelabstack)
 GITHUB_RUNNER_ACCESS_TOKEN=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
+
+# =============================================================
+# DEV STACK
+# =============================================================
+# Gitea
+GITEA_DB_PASSWORD=gitea_d3vp4ss_9f2k
+
+# VS Code in browser (code-server)
+CODE_SERVER_PASSWORD=c0de_s3rver_pass
+
+# BookStack wiki
+BOOKSTACK_DB_PASSWORD=bookstack_d3v_pass
+BOOKSTACK_DB_ROOT_PASSWORD=bookstack_r00t_pass
+
+# Plane project management
+# Rotate with: openssl rand -hex 32
+PLANE_SECRET_KEY=60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b52
+PLANE_DB_PASSWORD=plane_d3v_p4ss_8x3m
+PLANE_MINIO_USER=planeadmin
+PLANE_MINIO_PASSWORD=plane_minio_p4ss
+
+# Vault unseal keys + root token (generated 2026-06-04 during init)
+# Need any 3 of 5 keys to unseal after a restart.
+# Re-unseal with: apply-compose.ps1 -VaultUnseal  (or manually via SSH)
+VAULT_UNSEAL_KEY_1=fDQVnopNwCDXkUehLdQTpSasymm6h4yGheBKUNdz+jHM
+VAULT_UNSEAL_KEY_2=ix34PMxiwdpZQlzIBuxeWVgBGU/bhyomBR1BOA3NnGvJ
+VAULT_UNSEAL_KEY_3=SWXVKnhoYsT6XNiUnWKgTgle2JwsRUNZzX4J3XK++l6n
+VAULT_UNSEAL_KEY_4=rjSgX+lie2ulhJpm+yiWf3mY0hd+8JI6zbPlJPN5Scm+
+VAULT_UNSEAL_KEY_5=UIt78/Qi+rO+krJ4Nt0quTGHQlj+MYaXqt+kt7pAqDma
+VAULT_ROOT_TOKEN=hvs.QmhZvkXnFfebbRC7JVFLcNPn