feat: add full dev stack (Gitea, code-server, registry, DBX, Vault, BookStack, Plane)

- dev-compose.yml: 16-service dev stack on dedicated devstack network
- vault.hcl: Vault file-backend config; Vault initialized and unsealed
- docker-compose.yml: add devstack as external network on caddy
- Caddyfile: LAN-only site blocks for all 7 dev services; Plane routed
  via Caddy path handles (no bundled proxy container)
- apply-compose.ps1: add -DevStack and -VaultUnseal flags
- .env: dev stack secrets + all 5 Vault unseal keys + root token

Dev URLs (LAN-only): gitea, code, registry, dbx, vault, docs, plane
Stack managed by Portainer as dev-stack (id 7)

docker-compose.yml

@@ -77,6 +77,7 @@ services:
       - authentik
       - management
       - portainer_proxy
+      - devstack
     ports:
       - "80:80"
       - "443:443"
@@ -781,6 +782,8 @@ networks:
   management:
   portainer_proxy:
     external: true
+  devstack:
+    external: true
 
 volumes:
   minio_data: