dev: add parallel dev environment under /docker/dev

Near-1:1 clone of the prod remote-access stack, isolated on a new external
dev_edge network and fronted by the same shared Caddy instance (dual-homed on
edge + dev_edge). Dev is manual-start (not on boot).

- Hostnames: app-dev / api-dev .linumiq.net, tunnels under *.dev.linumiq.net,
  dev tunnel ingress on port 7001.
- Dev Supabase (project supabase-dev, *-dev containers), web, frps, redis,
  stripe-stub, bandwidth-worker with fresh independent secrets (gitignored).
- Shared Caddyfile: app-dev -> web-dev, api-dev -> dev kong (+webhook block),
  *.dev -> frps-dev vhost. Caddy compose dual-homed on dev_edge.
- On-demand-TLS authorizer (prod check-subdomain, in gitignored volumes/)
  extended additively: app-dev/api-dev -> 200; *.dev delegated to the dev
  authorizer. Prod allow-list logic unchanged.
- dev.sh manual up/down/ps helper; README documents topology + secrets.

Secrets, frps.toml, volumes/, web worktree and data dirs are gitignored.

dev/dev.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+# Manual start/stop helper for the dev stack (/docker/dev).
+# Dev is intentionally NOT started on boot; bring it up explicitly when needed.
+set -uo pipefail
+
+DEV_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Start order matters: redis + supabase first (web/worker depend on them).
+ORDER=(redis supabase frps stripe-stub bandwidth-worker web)
+
+ensure_network() {
+  docker network inspect dev_edge >/dev/null 2>&1 || docker network create dev_edge
+}
+
+cmd="${1:-}"
+case "$cmd" in
+  up)
+    ensure_network
+    for d in "${ORDER[@]}"; do
+      echo "==> up: $d"
+      if [ -f "$DEV_DIR/$d/Dockerfile" ]; then
+        (cd "$DEV_DIR/$d" && docker compose up -d --build)
+      else
+        (cd "$DEV_DIR/$d" && docker compose up -d)
+      fi
+    done
+    ;;
+  down)
+    for ((i=${#ORDER[@]}-1; i>=0; i--)); do
+      d="${ORDER[$i]}"
+      echo "==> down: $d"
+      (cd "$DEV_DIR/$d" && docker compose down)
+    done
+    ;;
+  ps)
+    docker ps --filter "name=-dev" --format "{{.Names}}\t{{.Status}}" | sort
+    ;;
+  *)
+    echo "usage: $0 {up|down|ps}" >&2
+    exit 2
+    ;;
+esac