feat: add full dev stack (Gitea, code-server, registry, DBX, Vault, BookStack, Plane)

- dev-compose.yml: 16-service dev stack on dedicated devstack network
- vault.hcl: Vault file-backend config; Vault initialized and unsealed
- docker-compose.yml: add devstack as external network on caddy
- Caddyfile: LAN-only site blocks for all 7 dev services; Plane routed
  via Caddy path handles (no bundled proxy container)
- apply-compose.ps1: add -DevStack and -VaultUnseal flags
- .env: dev stack secrets + all 5 Vault unseal keys + root token

Dev URLs (LAN-only): gitea, code, registry, dbx, vault, docs, plane
Stack managed by Portainer as dev-stack (id 7)

apply-compose.ps1

@@ -11,12 +11,16 @@
 #   powershell -File apply-compose.ps1 -Caddy      # Caddyfile only + hot-reload Caddy
 #   powershell -File apply-compose.ps1 -Compose    # docker-compose.yml only + pull + up -d
 #   powershell -File apply-compose.ps1 -Portainer  # portainer-compose.yml only + up -d
+#   powershell -File apply-compose.ps1 -DevStack      # dev-compose.yml + vault.hcl + up -d
+#   powershell -File apply-compose.ps1 -VaultUnseal   # unseal vault after restart (uses keys from .env)
 
 param(
     [switch]$Compose,
     [switch]$Caddy,
     [switch]$EnvFile,
-    [switch]$Portainer
+    [switch]$Portainer,
+    [switch]$DevStack,
+    [switch]$VaultUnseal
 )
 
 $ErrorActionPreference = "Stop"
@@ -28,9 +32,11 @@ $composeLocal     = Join-Path $PSScriptRoot "docker-compose.yml"
 $caddyLocal       = Join-Path $PSScriptRoot "Caddyfile"
 $envLocal         = Join-Path $PSScriptRoot ".env"
 $portainerLocal   = Join-Path $PSScriptRoot "portainer-compose.yml"
+$devComposeLocal  = Join-Path $PSScriptRoot "dev-compose.yml"
+$vaultConfigLocal = Join-Path $PSScriptRoot "vault.hcl"
 
 # Default (no flags): push everything.
-if (-not $Compose -and -not $Caddy -and -not $EnvFile -and -not $Portainer) {
+if (-not $Compose -and -not $Caddy -and -not $EnvFile -and -not $Portainer -and -not $DevStack -and -not $VaultUnseal) {
     $EnvFile = $true; $Caddy = $true; $Compose = $true
 }
 
@@ -62,4 +68,30 @@ if ($Portainer) {
     ssh $server "docker compose -f ~/valhalla-lab/portainer-compose.yml up -d"
 }
 
+if ($DevStack) {
+    Write-Host "Pushing dev-compose.yml ..."
+    scp $devComposeLocal "${server}:~/valhalla-lab/dev-compose.yml"
+    Write-Host "Pushing vault.hcl ..."
+    ssh $server "mkdir -p /config/vault/config /config/vault/data /config/vault/logs"
+    scp $vaultConfigLocal "${server}:/config/vault/config/vault.hcl"
+    Write-Host "Pulling latest dev images ..."
+    ssh $server "docker compose -f ~/valhalla-lab/dev-compose.yml --env-file ~/valhalla-lab/.env pull"
+    Write-Host "Applying dev stack (recreates only changed containers) ..."
+    ssh $server "docker compose -f ~/valhalla-lab/dev-compose.yml --env-file ~/valhalla-lab/.env up -d"
+}
+
+if ($VaultUnseal) {
+    # Load the three unseal keys from .env
+    $envContent = Get-Content $envLocal | Where-Object { $_ -match "^VAULT_UNSEAL_KEY_[123]=" }
+    $keys = $envContent | ForEach-Object { ($_ -split "=", 2)[1] }
+    if ($keys.Count -lt 3) {
+        Write-Error "Could not find VAULT_UNSEAL_KEY_1/2/3 in .env"
+        exit 1
+    }
+    Write-Host "Unsealing Vault (3 of 5 keys) ..."
+    foreach ($key in $keys) {
+        ssh $server "docker exec vault vault operator unseal $key 2>&1 | grep -E 'Sealed|Error'"
+    }
+}
+
 Write-Host "Done."