feat: add full dev stack (Gitea, code-server, registry, DBX, Vault, BookStack, Plane)

- dev-compose.yml: 16-service dev stack on dedicated devstack network
- vault.hcl: Vault file-backend config; Vault initialized and unsealed
- docker-compose.yml: add devstack as external network on caddy
- Caddyfile: LAN-only site blocks for all 7 dev services; Plane routed
  via Caddy path handles (no bundled proxy container)
- apply-compose.ps1: add -DevStack and -VaultUnseal flags
- .env: dev stack secrets + all 5 Vault unseal keys + root token

Dev URLs (LAN-only): gitea, code, registry, dbx, vault, docs, plane
Stack managed by Portainer as dev-stack (id 7)

Caddyfile

@@ -213,4 +213,54 @@ homarr.ginnoir.com {
 router.ginnoir.com {
 	import internal_only
 	reverse_proxy 192.168.1.1
+}
+
+# =============================================================
+# DEV STACK — internal only
+# =============================================================
+gitea.ginnoir.com {
+	import internal_only
+	reverse_proxy gitea:3000
+}
+
+code.ginnoir.com {
+	import internal_only
+	reverse_proxy code_server:8443 {
+		transport http {
+			tls_insecure_skip_verify
+		}
+	}
+}
+
+registry.ginnoir.com {
+	import internal_only
+	reverse_proxy registry:5000
+}
+
+dbx.ginnoir.com {
+	import internal_only
+	reverse_proxy dbx:4224
+}
+
+vault.ginnoir.com {
+	import internal_only
+	reverse_proxy vault:8200
+}
+
+docs.ginnoir.com {
+	import internal_only
+	reverse_proxy bookstack:80
+}
+
+plane.ginnoir.com {
+	import internal_only
+	handle /api/* {
+		reverse_proxy plane_api:8000
+	}
+	handle /auth/* {
+		reverse_proxy plane_api:8000
+	}
+	handle {
+		reverse_proxy plane_web:3000
+	}
 }