build: M1 Dockerized development stack with PHP skeleton, config/logging, Tailwind assets, and wrappers

Implements MeshVault M1 (issues #6–11):

- Four-service Docker Compose stack (nginx, PHP-FPM 8.3, PostgreSQL 17, Node assets)
- Slim 4 + PHP-DI routing with escaped PHP views and production/dev error handling
- Immutable validated AppConfig with redacted diagnostics
- JSON stdout Monolog logging with job-scoped context
- Tailwind CSS v4 deterministic locked builds with template scanning
- POSIX and PowerShell dev wrappers (up/down/test/lint/assets/watch)
- Startup config validation fails before FPM serves as unprivileged www-data
- migrate/seed explicitly unavailable until M2 (#12); #10 remains open

Verified via clean-start acceptance on remote host (keith@192.168.2.23).

CONTRIBUTING.md

@@ -1,8 +1,26 @@
-# Contributing to MeshVault
+# Contributing to MeshVault
 
 ## Setup and checks
 
-Use PHP 8.3+ and Composer 2. Run from the repository root:
+Host requirements: Docker Compose v2+ with Linux containers. No host PHP,
+Composer or Node is required.
+
+```sh
+# Start the stack (builds images if needed)
+./dev.sh up
+# Or on Windows: .\dev.ps1 up
+
+# Run checks inside containers
+./dev.sh test
+./dev.sh lint
+
+# Build assets deterministically
+./dev.sh assets
+# Watch during development
+./dev.sh watch
+```
+
+If you have PHP 8.3+ and Composer 2 locally, you can also run:
 
 ```sh
 composer install --no-interaction
@@ -11,17 +29,14 @@ composer lint
 composer test
 ```
 
-Commit `composer.lock` for reproducible development tooling. PHP_CodeSniffer is a
-development dependency, not an application framework. Composer scripts use PHP and
-local vendor binaries so they work in PowerShell as well as Unix shells.
+Commit both `composer.lock` and `package-lock.json` for reproducible builds.
+`migrate` and `seed` are unavailable until M2 (#12); they exit nonzero and leave
+#10 open. Never remove volumes with `down -v`; the wrapper forbids it.
 
-`composer lint` enforces PSR-12 on PHP in `src`, `public`, `db/migrations` and
-`tests`. `composer test` currently checks only repository foundations. Add behavior
-and regression tests with each implementation; the HTTP/database test framework
-will be selected with the application skeleton (#7), not assumed here.
-Docker, database migrations, Node/Tailwind builds and CI are not implemented yet.
-Do not use undocumented application commands or mistake foundation checks for
-integration coverage.
+`composer lint` enforces PSR-12 on PHP in `src`, `public`, `config`, `bin`,
+`templates`, `db/migrations` and `tests`. `composer test` runs foundation checks
+and PHPUnit unit/integration tests. Add behavior and regression tests with each
+implementation.
 
 ## Conventions